Jan 5, 2018 · 57m · y-combinator
Leah Culver of Breaker and Tom Sparks of YC Answer Your Questions About Security and Podcasting · Y Combinator
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
In this Q&A session hosted by Craig, Y Combinator's Tom Sparks and Breaker co-founder Leah Culver dive deep into cybersecurity best practices, authentication evolution, startup development, and the future of the podcasting industry.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. How this is scored →
The partners as informed peer 2.8 Guest teaching 3.9 Guest disagreement 0.5 The partners pushing back 0.2
speaking balance: gold is the partners, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 36:56 Challenging default platform dominance
Craig directly questions Leah's assumption that default installation guarantees market dominance, pointing out Apple Maps losing out to Google Maps.
Hardest push from the partners ▶ 36:56 Counterexample to default app superiorityCraig refuses the notion that native distribution alone wins podcast market share, citing Google Maps' conquest of iOS users over Apple Maps.
Biggest teaching moment ▶ 9:26 Categorizing multi-factor authentication securityLeah methodically educates the room on the distinct categories of authentication—knowledge, possession, and biometric inheritance—and the distinct threat models of each.
The partners hold their own ▶ 41:46 Craig details podcast interviewing mechanicsCraig steps into an instructional role, explaining the nuanced mechanics of host energy calibration, intro editing, and listener hook techniques.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | The partners as informed peer | Guest teaching | Guest disagreement | The partners pushing back | Why |
|---|---|---|---|---|---|---|
| Government Access and Device Vendor Security Policies | 1 | 4 | 1 | 0 | Craig introduces a listener question regarding government surveillance and vendor security policies. Tom offers a detailed historical breakdown ranging from 1960s surveillance programs to Apple's modern device encryption stance. | |
| Personal Security Habits and Device Authentication Measures | 2 | 4 | 0 | 0 | Craig prompts the guests on personal device security habits. Leah explains specific operational security measures such as single-finger biometric registration and powering down devices before law enforcement contact. | |
| Application Development Security Practices and Government Requests | 2 | 5 | 1 | 0 | Craig asks how Breaker manages security at the corporate level. Leah delivers practical engineering guidance against storing sensitive PII in info.plist or user defaults and highlights corporate transparency reports. | |
| Authentication Technology Evolution and Biometric Security Risks | 3 | 5 | 1 | 1 | Craig introduces questions on the progression of auth technology. Leah and Tom classify authentication factors into knowledge, possession, and inherence, analyzing the trade-offs of facial recognition masks and hardware tokens. | |
| YC Internal Data Security and Modern Startup Security Frameworks | 3 | 5 | 0 | 0 | Tom explains Y Combinator's internal security hygiene and argues against startups reinventing auth mechanisms. Leah corroborates based on her background co-authoring the original OAuth specification. | |
| Risks of SMS Two-Factor Authentication and Secure Alternatives | 2 | 5 | 1 | 0 | The panel discusses SIM swapping attacks and cryptocurrency vulnerabilities. Leah strongly advises against SMS-based two-factor authentication due to telecom customer support vulnerabilities, while Tom notes human error remains the primary crypto attack vector. | |
| Podcast Recommendations and Content Gaps in Security and Tech | 2 | 2 | 0 | 0 | Craig facilitates a discussion on favorite podcasts and identifies content gaps. Leah and Tom observe an unmet demand for deep technical security podcasts and hardware-focused audio content. | |
| Entrepreneurial Mistakes and Embracing Authentic Founder Identities | 2 | 3 | 0 | 0 | Tom shares early startup mistakes surrounding excessive spending and vanity expenses. Leah explains her shift toward listening to customer feedback and overcoming founder imposter syndrome. | |
| Breaker's User Feedback Mechanisms and the Podcast Industry | 3 | 4 | 1 | 2 | Leah reviews telemetry and user research methodologies used at Breaker. Craig pushes back on the default dominance of Apple Podcasts by comparing it to the displacement of Apple Maps by Google Maps. | |
| Episode-Based Podcast Discovery and the Future of Premium Audio | 2 | 4 | 1 | 0 | Leah articulates Breaker's thesis of prioritizing episode-level discovery over show-level discovery and compares the growth trajectory of original podcast production costs against prestige television. | |
| Podcast Production Insights, Host Energy, and Audio Transcription | 6 | 2 | 0 | 0 | Leah turns the interview to ask Craig about his production strategy. Craig takes full command of the topic, sharing detailed expertise on host room energy, pacing, cold opens, and editing workflows. | |
| Developer Secret Management, Passive Social Sharing, and Privacy | 3 | 4 | 0 | 0 | Tom and Leah debate developer secret management tools and the design challenges of passive activity sharing versus user privacy controls in media platforms. | |
| Security Education, Open Source Frameworks, and Core Engineering Values | 5 | 3 | 0 | 0 | The panel discusses effective entry pathways into computer security. Craig contributes a practical philosophical takeaway on engineering, emphasizing mastery of existing core tools over chasing new frameworks. |
Statements from this episode (19)
Sparks: Government Cannot Force Apple to Decrypt Data, Android Is Less Secure
“They can't make Apple decrypt what you've got. If you've got an Android phone, you're much less well off.”
Culver: Law Enforcement Accesses Biometrics More Easily Than iPhone Passcodes
“I think it's much easier for law enforcement to access your phone via touch ID, like you were saying through touch ID or facial recognition. But the nice thing Apple does is if you have three failed attempts, Or if you shut off your phone, you have to reenter …”
Culver: Register only one thumb to intentionally trigger iPhone passcode lockouts
“I tend to only put one of my thumbs in the thumbprint so that if I needed to, I could use my other thumb and just pretend like, oh, it's just, I'm nervous. It's not working. Until it locks me out.”
Culver: iOS developers must store sensitive data in Keychain, not Info.plist
“Big thing for me is keeping private data in the key chain. It's an iOS developer and not in any other local files, especially not in NS user defaults or putting it in the info.plist file. Don't put stuff in there. You can unzip An app directory to look at anyo…”
Sparks: Two-factor authentication concepts date back to the 1880s
“Two-factor auth, you know, kind of started with one-time passwords. That stuff was originated in the 18 eighties. So like, it's really not new.”
Sparks: Consumer devices will probably adopt DNA or chemical identification
“Looking forward, I think we'll even see probably like DNA ID. I mean, sensors are getting smaller and smaller all the time. You know, you can detect so many different factors, like humans have, you know, unique chemical fingerprints even. So you could have som…”
Culver: Passwords surpass biometrics because compromised credentials can be replaced
“What's really nice about the device and something you remember is you can replace it. So if it were to get stolen, so if someone takes a cast of your It's a lot harder to change your thumbprint than it is to change your password, right? So a nice nice security…”
Sparks: A personal friend was first to break iPhone Touch ID
“Funnily enough, a buddy of mine was the first person to break the touch ID on the iPhone.”
Sparks: Reinventing security mechanisms is the worst mistake developers can make
“I think there's a good trend of people just not reinventing the wheel for security. Reinventing the wheel is pretty much the worst thing you can do. I mean, every time we see, you know, a big hack, it's because of somebody did something where they're like, oh,…”
Sparks: Startups should outsource authentication rather than build custom auth systems
“I think outsourcing auth is a really important thing. You know, a lot is great. You know Samuel is great. Most companies don't really need to worry about auth, you know, in, in that way, you know, Facebook auth is great. It's ubiquitous. It's pretty solid, you…”
Culver: 20 to 30 people worked on OAuth's first version
“So I worked on OAuth the first version. Which is maybe not as good as subsequent versions, but worked on the first version, but it was a large team. I'd say at any given time we had, you know, 20, 30 people working on different parts of it.”
Culver: User error is the number one security concern in crypto
“Some of the biggest security concern right now, I'd say the number one is user error, right?”
Cannon: Annual Podcast Ad Revenue Is Roughly $250 Million
“I mean, I think it's two hundred and fifty million a year now in like ad revenues, which is like tiny considering how much people talk about podcasting.”
Culver: Producing a TV show is roughly 100x more expensive than a quality podcast
“It's like a hundred X more expensive to produce a television show than to produce a podcast, a quality podcast.”
Cannon: Podcast hosts must actively manage room energy rather than relying on guests
“I've recognized how important it is to control the energy in the room, and as the host, it's totally on you. A lot of people think, oh, you know, I'll just bring in Leah and Tom, and they're gonna be super fun. This is gonna be great. And you are both super fu…”
Cannon: Podcasters must transcribe audio because Google cannot index it
“I would also say to podcasters, definitely transcribe your stuff, because Google is not friendly to audio, and you want that, like, index stuff right there.”
Culver: Secret management is a huge market opportunity in developer security
“I think there's a huge opportunity in security to do sort of secret management. Like, right now, things are just like, oh, put in an n variable, or whatever, it's like so bad, and for us, as soon as you have a team of more than, like, two people, you need to b…”
Sparks: Smart scales will provide personalized dietary advice within five years
“Five years, we'll probably have a scale that'll be like, oh, you know, should probably cut out eating this, or you should eat more of this, or something like that. I think we'll see some pretty interesting consumer technologies come out of, you know, weird pot…”