- The discussion begins with a question about how to handle increasing government pressure to access devices.
- The speaker mentions that legislation plays a role in this issue and highlights Apple and Microsoft as vendors that prioritize user privacy and security.
- The government's ability to subpoena device information is discussed in relation to personal privacy and the Fourth and Fifth Amendments.
- The importance of using security measures like passcodes and biometric authentication is emphasized for personal device protection.
- The speaker mentions that Apple has resisted giving the government access to user data, while Android phones are considered less secure.
- The discussion shifts to the company side, where best practices for app developers to protect sensitive data are mentioned.
- Transparency in how companies handle government requests is highlighted, with examples from Dropbox.
- The second question addresses the changing nature of authentication technology and the trade-off between convenience and security.
- The speaker discusses the historical origins of two-factor authentication and the increasing awareness of personal security.
- The importance of speed and reliability in authentication technology is mentioned, and future possibilities like DNA ID and heartbeat detection are suggested.
- The concept of multi-factor authentication is explained, including factors such as something you know, something you are (biometric), and something you have (device).

- The YubiKey and Authenticator app are both devices used for authentication, with pros and cons to each.
- The convenience of facial and thumbprint recognition is appealing, but the ability to replace a device is a security advantage.
- Changing a thumbprint or face is more difficult than changing a password, so it is important to have a backup passcode.
- The convenience of biometric authentication is preferred by many, but there is a risk of someone faking a mask of your face.
- YC takes precautions to protect data, including strong passwords, encryption, and VPN.
- Outsourcing authentication through OAuth or other established methods is recommended to avoid reinventing the wheel.
- Continuous integration software and frameworks can help automate security checks in code.
- Best practices and open standards should be used when building websites or apps for security.
- There is room for innovation in the user experience side of security, such as Face ID and preventing targeted attacks.

- The speaker discusses the importance of security in product development, particularly in preventing unauthorized changes to email addresses and passwords.
- They mention the vulnerability of using SMS or phone calls for multi-factor authentication and recommend using Google Authenticator or similar applications instead.
- The speaker talks about the security concerns in cryptocurrency and emphasizes the need for user caution and protection against user error.
- They also mention their fascination with the blockchain technology and its potential to decentralize power and data.
- The speaker recommends a podcast called "Invest Like the Best" for those interested in learning more about cryptocurrency and blockchain technology.
- They express a desire for more diverse storytelling podcasts and mention their favorite podcast, "The Life of Boris."
- The need for more in-depth security podcasts is mentioned, as well as the positive experience with Breaker's search feature.
- The question about mistakes made in the first company and lessons learned for the second company is raised, but no specific answers are given.

- The speaker highlights two common mistakes in startups: poorly spending money and not asking for help.
- They emphasize the importance of being frugal and listening to user feedback.
- The speaker discusses their struggle with fitting the mold of a startup founder and encourages being true to oneself.
- They mention their user testing methods, including bug reporting, Mixpanel, and surveys.
- The speaker talks about the challenge of podcast discovery and the focus on episode discovery rather than show discovery.
- The goal of Breaker is to become a source of high-quality podcast content, similar to Netflix.

- The speaker discusses the strategy of gaining a large audience through Breaker and then presenting them with high-quality, unique content
- Producing a podcast is much cheaper and easier than producing a television show
- The speaker does not create podcasts but is involved in the technical side
- The speaker emphasizes the importance of controlling the energy in podcast interviews and the need for editing
- Transcribing podcasts is recommended for better indexing on search engines
- The speaker mentions future ideas including transcribing podcasts on Breaker and the potential for security-related technologies and biometrics

- The speaker discusses the concept of passive sharing and the lack of apps that currently utilize it
- They mention Breaker and Spotify as examples of apps that passively share user activity
- They mention the importance of privacy on Breaker and invite users to provide feedback on how privacy should be implemented
- The speaker expresses interest in working on an open source project related to mobile and web development
- They recommend reading blogs and Hacker News for learning about security and suggest participating in Capture the Flag activities
- The speaker mentions the importance of learning about IoT security and suggests exploring Shodan for interesting vulnerabilities
- They mention insecure.org as a resource for learning about new vulnerabilities
- The speaker mentions the importance of being proficient in the tools and languages used regularly in software development
- They express a preference for mastering a few tools rather than constantly seeking out new ones

- The discussion addresses government pressure to access devices and highlights Apple and Microsoft as companies that prioritize user privacy.
- The importance of personal device protection through security measures like passcodes and biometric authentication is emphasized.
- The differences in security between Apple and Android phones are mentioned.
- Best practices for app developers to protect sensitive data and handle government requests transparently are discussed.
- The changing nature of authentication technology and the trade-off between convenience and security are explored.
- The concept of multi-factor authentication and devices like YubiKey and Authenticator app are mentioned.
- The speaker emphasizes the importance of security in product development and recommends using Google Authenticator for multi-factor authentication.
- The security concerns in cryptocurrency and the potential of blockchain technology are discussed.
- Recommendations for podcasts and resources to learn about security and software development are provided.
- The speaker discusses their involvement in the technical side of podcasting and highlights the importance of controlling energy in interviews.

Leah Culver - https://twitter.com/leahculver - is cofounder and CTO of Breaker - https://www.breaker.audio/ - which is a social podcast listening and discovery app. They went through YC in the Winter 2017 batch. Leah’s also an author of both the OAuth and oEmbed API specifications.

Tom Sparks - https://www.linkedin.com/in/tom-sparks-46562/ - is an engineer on the YC Software team. He also cofounded Cryptoseal which went through YC in the Summer 2011 batch and was acquired by CloudFlare in 2014.

The YC podcast is hosted by Craig Cannon - https://twitter.com/craigcannon

All right, so how about we start with some questions from Twitter?

I actually think this 1 might have been on Facebook.

So Brady Simpson asked, how do we deal with the ever increasing pressure from governments trying to get into devices?

So I think 1 of the most important things to think about is that some of this is just legislation-based.

However, some vendors do actually care about the privacy and security of their users.

Microsoft has actually done a lot of work for this.

Previously when Blackberry was still a thing they were basically number 1, but right now Apple's pretty much the most consumer-friendly in terms of security for just your personal devices.

They give you a lot of options, they do a lot of stuff behind the scenes to make it really easy.

Your passcode is actually backed by some really, really cool stuff.

Your fingerprint reader on your phone is pretty simple.

The government trying to subpoena the information from your devices is a lot bigger can of worms.

And it kind of goes back to, you know, the Constitution essentially, like Fourth Amendment, Fifth Amendment stuff.

So, search and seizure is really kind of up in the air with electronic devices.

You know, this kind of goes all the way back to the 1960s in terms of personal privacy.

In the 60s, the government came up with something called Echelon I believe and you know that was basically trying to get data to spy on spies.

You know in the in the 90s it was you know Clinton trying to do stuff to catch more spies basically and with email and stuff becoming more and more prevalent they Just you know put in this giant apparatus to do surveillance on the American population.

So vendors, when they tackle this, kind of have to go, well, what can we do without taking off the government?

Apple's done a good job of basically saying, no, we're not going to give you the keys to things.

If you want to get into somebody's phone, you're going to have to basically get around the protections we've put in because We don't want to make something that's intentionally insecure And and they've done pretty well with that they've gotten some flack from some people but

so as a layperson like what precautions are you taking with your own data?

I think for the most part, you know, as long as you use the the key code and you know any sort of like biometric authentication on your on your devices, you're in a good spot.

If you don't do any of that You're kind of you're just kind of the wind You know the government has pretty deep ability to surveil you so your phone is probably Not really gonna be the vector they go after the most, unless you're sending encrypted messages and stuff.

If you've got Signal, they probably want to see what you're doing.

But if they can subpoena you and you don't have good protection on your phone, they're going to see what's there.

They can't make Apple decrypt what you've got.

If you've got an Android phone, you're much less well off.

So It's really just, you know, legislation and using good technology.

I believe the Pixel 8, or the, what is it?

The new Samsung phone has some pretty neat stuff built into it that's got good security.

I'm actually, so I have an iPhone and I have some little paranoia things.

So if I was like panicked, so I do, I actually just got the iPhone 10, so I have the facial recognition.

But I always tend to get the latest iPhone, so I had the Touch ID as well.

And the interesting thing is I think it's much easier for law enforcement to access your phone via Touch ID, like you were saying, through Touch ID or facial recognition.

But the nice thing Apple does is if you have 3 failed attempts or if you shut off your phone, you have to reenter your passcode.

And that's much harder for them to access.

So I've practiced like powering down my phone.

I tend to only put 1 of my thumbs in the thumbprint so that if I needed to, I could use my other thumb and just pretend like, oh, it's just, I'm nervous, it's not working until it locks me out.

I don't know, is that all weird and paranoid?

I feel like it's the price you pay, you know, It's like the trade-off for using some of the convenience features.

So at Breaker, how do you guys think about security?

So we basically follow sort of standard web service practices.

So a big thing for me is keeping private data in the key chain as an iOS developer and not in any other local files, especially not in NSUserDefaults or putting it in the info.plist file.

You can unzip an app directory to look at anyone's info.plist, which is great.

I actually use it to find out what other apps are doing for certain Apple-specific settings because they have these weird configurations that you can do for interoperability with other apps and it never seems to work so I was just like, download people's apps and unzip them and look at their info.plists.

But yeah, just making sure that as an app developer, when you're storing sensitive data, such as passwords, usernames, any PII, personally identifying information about people, that you are doing so in a thoughtful way.

And I think there are a lot of best practices about this.

And I don't want to go into all of them, but it's pretty easy to just Google and find out what they all are.

And just to be aware of it, just to know that you have sensitive data and power, and to be really aware that you have a responsibility as an app developer to protect that data.

And actually it was interesting, I was thinking about cloud services and the government accessing cloud services.

And my last job was at Dropbox, and a lot of other companies do this as well.

They publish all of the requests from the government.

So the legal team publishes them all online through like a disclosure report every year.

But yeah, and it's part of the, most companies today who are behaving well don't want to be overly generous with providing data to the government, but under certain legal conditions it is necessary.

But making that all very transparent to users when you sign up for a service, knowing how they deal with government requests.

Cool, well let's go to Brady's second question then.

So he asks, why is auth tech changing every few years?

From YubiKeys to two-factor auth to thumbprint to face recognition, what are we optimizing for?

Edith Winkler Honestly, like the face ID thing, I think I like the Animoji, like the making animals talk.

And yeah, I think I like that more than the actual security part of it.

But yeah, it's this trade-off between convenience and security, right?

So I think a lot of these new technologies coming out are for convenience.

I see her Tom's thoughts on these things too.

I mean, all this stuff is actually really old.

It's just the thing that we're actually using it now.

Like, I went back and looked and two-factor auth kind of started with one-time passwords.

Really what it is is people are becoming more aware of their own security, they wanna make sure that whatever personal data they have doesn't get out there.

Most people have really terrible passwords and they're sort of like, oh, OK, even if I have this terrible password, if I use this little thing, it'll keep my personal data safe.

I mean, I don't think that the way that we implement it is necessarily what matters.

I think it's just the fact that people are using it more and becoming more aware.

You know, I think speed and reliability are really important.

When you look at what's available, I think if you go back, I have a laptop from the 90s that has a fingerprint reader on it.

We never really used it, but it was the thing that you could use.

There's more multi-factor auth and things.

I think looking forward, I think we'll even see probably DNA ID.

I mean, sensors are getting smaller and smaller all the time.

You can detect so many different factors.

Humans have unique chemical fingerprints even.

So you could have something where it's like, oh, my phone smells me or something like that.

What's interesting about this is that like It's not just about 2, like we talk about two-factor authentication, what it really is is multi-factor authentication and having those factors be of different types.

I'm gonna try and remember the different types, but there's something you know, something you are, like biometric, And what's the, what's another 1?

So device biometric and something you remember, like a password.

And so having 2 different factors, I think is the key for two-factor authentication.

So like a YubiKey is a device, or if you have Authenticator on your phone, like an Authenticator app, that's like a device 1.

The thumbprint facial recognition is biometrics.

And there's pros and cons to each, right?

So what I find super interesting is I love the convenience of the face and the thumbprint, But what's really nice about the device and something you remember is you can replace it.

So if it were to get stolen, so if someone takes a cast of your thumbprint, it's a lot harder to change your thumbprint than it is to change your password, right?

So a nice security feature is the ability to change something if you feel like it's been compromised to make a new password or to change up your device.

The device one's a huge pain in the ass because every time I get a new iPhone I spend the next like hour switching over all my authenticator keys.

Did you read the post about the mask faking out the iPhone X?

Yeah, but it's super scary because it's not like you're gonna change your face, right?

So having it as a second factor or having that as the, I guess it's the first factor, right?

It's the first protection, but having the passcode as the backup for that is super important.

Yeah, I've just been wondering if there's like a line for you guys where you're like, you know what, face ID, I'm good.

Like, I don't need this right now because I'm gonna like, just like you said, there is a point at which if someone hacks you or figures out a way or some exploit, it's open forever.

Are there certain lines like or is the convenience also for security minded people just so high that you opt into it?

I'm a big 1 password user so I don't I don't actually know any of my passwords except my 1 password And now it's 2 taps I think.

You tap once on the button that says look up my password and it does the face or watch condition on 1 password.

And then you tap the password that you want to enter.

It's just because it knows what site it's on or whatever and it's just so fast.

Whereas you know I've been using Password manager for ages, and it's such a pain to like switch apps like get the password and copy it paste it in Yeah, so it is the convenience is phenomenal But what is the risk that I hope no 1 takes a mask in my face.

you use any 2 factor devices or biometric stuff?

Yeah, I mean, I, well, I don't do as much data center stuff anymore, but I've definitely done a lot of the biometric auth stuff.

Funnily enough, a buddy of mine was the first person to break the touch ID on the iPhone.

He also recently published something about the guys who did the mask thing.

I mean, there's a few things that Apple did to try to make sure that there's some liveness and some other stuff, but it's hardware at the end of the day.

So it's not, you know, it's a little fallible, but it's not bad.

Yeah, like there's the setting on the facial recognition where if your eyes are closed, it won't read your face, which is really, because I assume that's like, to protect yourself, you could just close your eyes.

It's not like the left thumb, right thumb thing that you're talking about.

Like if you show your phone to your face and you close your eyes, someone knows that you're trying to fake it.

So someone, Tom, asked specifically about YC.

So Rick Deacon asked, what precautions does YC take to protect data?

So I mean we deploy, you know, best practices.

We don't do anything, you know, super, super scary.

You know, we We just make sure that we know where our users are.

We make sure that people use strong passwords.

We have some dedicated hardware and stuff for VPNing, so that is kind of a little harder to remotely get into.

We do not have nuclear secrets or anything like that.

So I'm not worried about someone parachuting in with machine guns and chainsaws.

I mean, if you're a YC founder, your data is well protected.

And we want to make sure that that stays that way.

But we're not going to do DNA ID to get into something right.

So we do a pretty good job of just making sure that everything's pretty buttoned down and code views.

Yeah, it's a really good team, so that helps.

He asked, what is the future of security for startups?

I think There's a good trend of people just not reinventing the wheel.

For security, reinventing the wheel is pretty much the worst thing you can do.

I mean, every time we see a big hack, it's because somebody did something where they're like, oh, I'm going to be really clever and reinvent this thing.

And like, cool, you forgot this 1 thing, where if you add an extra 0 or something, like, oh, hey, look, this password's been cleared.

I think outsourcing auth is a really important thing.

Most companies don't really need to worry about auth, in that way, you know, Facebook Auth is great.

It's ubiquitous, it's pretty solid, you know, well-run company, you know, it's everywhere.

I think, you know, moving forward, like really it's just going to be what companies need, you know, most startups don't need, you know, crazy military grade stuff.

They don't need HSMs, they don't need TPMs even.

Your phone has a TPM in it, but it's so ubiquitous that you don't need it.

So having something like OAuth just removes the need for really trying to have to build in a lot of security.

Beyond that, a lot of CIs, continuous integration softwares, have things where you can just sort of turn on, like code checking.

You can do a lot of security stuff just automatically.

I mean, most developers do care somewhat about it.

But when you get the intern in, and they're like, oh, yeah, I wrote this great function that has 1 thing in it, they're not necessarily going to know.

that's why having some oversight is good.

But frameworks eliminate a lot of these problems.

There's a lot of really great frameworks out now.

I think, really now more than ever, there's just a lot of really good stuff.

Go has some pretty interesting stuff in it, just in terms of programming level security.

I made the joke the other day that if you need random numbers, the best way to get them is to use a language that doesn't have any sanity checking

Because they won't even know that they need to do memory management, there's something already there.

And Leah, would you advise the same thing?

I think when you're looking to build a website or an app or something, to use best practices as the way to go.

And these things are sort of open standards and open protocols for a reason, because large teams of people work on it.

Which is maybe not as good as subsequent versions.

I'd say at any given time we had 20, 30 people working on different parts of it.

And I'm personally not a security expert.

So it was fun to work with folks from Google, Yahoo, Mint.com, financial institutions who definitely had more at stake in terms of, rather than I was working on a social network at the time, a little less at stake than financial data.

But it was nice to have them sanity check, especially all the algorithms for hashing and to make sure that we were kind of doing things in a way that could protect against known attacks, things that people knew were vulnerabilities and vectors.

But nowadays, as just an app or web developer, you don't have to think about any of that.

To use Facebook login, it's like you download an SDK and you follow the instructions and it just works and it's secure and fantastic.

But that being said, I do think there is still room to innovate on the user experience side of security.

So that's when we talk about things like Face ID or like sort of new, what can we do now that we couldn't do 10 years ago, that we would have liked to, right?

So some of that stuff is fun to play with.

I'm really interested, so after working on OAuth, I'm still really interested in user login and all of the, especially preventing against targeted attacks is 1 of my fun hobbies.

And so some of the stuff you see now that I'm super interested in is when you log in on a new device, that you get an email about it, if your password changes, that you get notified.

How do you prevent someone changing the email address and changing the password at the same, too close together?

Some of those things are just product things to think about.

If you're developing a product that you need to be secure, what can you do in the case of both just general attacks to get data from your database or the more targeted attacks?

I don't know why that's interesting to me, I just find it fascinating, especially in the age of Instagram celebrities and things.

And people in general aren't super good about security.

So how can we as app developers protect someone in the case that they do have a terrible password.

Well I think you saw it, you know, with people porting phone numbers for crypto stuff in particular.

It really brought to attention how bad the cell phone companies were prepared for multi-factor authentication.

Like I don't use my phone for multi-factor authentication.

Yeah, not using SMS or phone calls or anything like that as a factor.

There's like Authy, there's some other ones that are pretty good.

I just, You know, like when you're relying on someone who gets probably paid minimum wage to sort of like be phone support.

I don't know if I would be counting on that.

And do you have crypto thoughts in general?

So Saif, I told you this before the podcast, Tom.

Saifullahi asked, what are the most recent security concerns in crypto or cryptocurrency, just to be clear?

I think really it's just, you know, it's new.

You know, People are sort of inventing their own languages to go along with them.

were talking about earlier with Ethereum the other week, where somebody kind of deleted a really important function out of a contract.

That stuff will happen, and people will just take that lesson and move on.

I don't think cryptocurrencies are necessarily more or less secure than anything else.

I mean, cash, If you leave it on a table, somebody's probably going to walk off with it.

We saw a lot of early Bitcoin stuff go away because people were using horribly insecure hosting stuff.

Hopefully people don't continue that, but I'm sure it will.

People leave their wallets with passwords of like 1234 on their laptops.

Some people will, I have seen wallets stored on public anonymous FTP sites with a password of like 1.

You know, you can't protect users from themselves, really.

I don't think I don't think crypto specifically has a problem.

I think it's interesting to see how people are using it.

I think it's kind of nice that you can have it be so ubiquitous.

And it's sort of like a it sort of brings power back to the people who use it a little bit versus like with cash or like, oh, central bank, you know, you have to do this.

See all Y Combinator transcripts on Youtube

Leah Culver of Breaker and Tom Sparks of YC Answer Your Questions About Security and Podcasting