You're wrong. I can think of many apps where security shouldn't be the main focus. Apps where neither the developer nor the users really care if it happens. Yo is one of them.

I didn't say it should be the main focus. Also, your comment demonstrates my point (thanks for that). It's arrogant, and demonstrates a lack of insight. If they don't, Yo should care. As I mention in another comment below, this impacts their reputation. Imagine if the developers of Yo build something that really should be secure one day. First thing I'd think is they don't bother with security, so I won't use that app. Or the developer interviews somewhere else one day -

Interviewer: "So dude, what have you done in your career?"

Yo dev: "I built Yo."

Interviewer: "Yo got hacked. Goodbye."

. . . said no interviewer ever.

And as selfishly awesome as it would be for my career if security holes became career-ending mistakes (hire me so you don't lose your job!), the only people who haven't written software with security holes are those who haven't written software.

I get it. Because absolute security is an impossibility, we just shouldn't bother at all.

See what you and I did there? Extremes, both sides of the argument. I know that no interviewer says that - it was done to illustrate my point.

I think you misunderstand the trouble one can cause through limited information. We can phish, we can gain access to some personal information.

Both of those pots of "gold" are threatening enough attack vectors.

What's the worst that could happen? I'm not trying to minimise the severity of their fail; I am genuinely curious if they could have pushed something malicious to user phones?

They are asking for users phone numbers: very sensitive data. Apparently that data is not being handled securely.

Respectfully (I mean no offence), your comment is typical of one that trivialises security. Information disclosure is one of only six threats (spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege). Threats (individually, or within a threat tree) lead to exploits, which if not mitigated, have consequences. They in turn have an impact.

The impact for Yo is not the degree of sensitivity of the data - that's semantic. The real impact is reputational. Trust is easily obtained, but very difficult to regain once lost.

> Trust is easily obtained, but very difficult to regain once lost.

I don't believe you. People still shop at Target, people still use Heartland payment processing systems, people still use Comodo and Verisign as digital certificate authorities. Stratfor still has customers, people still use Firefox, Internet Explorer and Chrome, and so on.

In this thread you ask people to care about security because of the harm it will bring to their reputation, but really you are the only person who considers the security reputation of a company, service, or product before using it. No-one else does. People in the world consider hackers and security problems to be a bit like tornadoes - what could you have done differently to avoid being hit by one?

And really, the track record for making secure software is very bad. Matasano is the premier application security consulting company in the world. Their blog got hacked. Microsoft is the premier software development company in the world, they invest billions comma billions of dollars in the security of their software, from paying internal red teams to giving grants to leading academics for groundbreaking research. Their software still gets hacked.

So what's your secret to making software secure? Is it more quotes from the CISSP handbook?

There is no secret, and I've not read the CISSP manual. I just design for it before I start writing code. Also, I don't ask anyone to care about anything. Your app, your choice. You mention tornadoes. That's reactive. I'm suggesting being proactive, by asking what can be done before an event, not after.

I know absolute security is elusive. I still try to anticipate what might happen, however. As Covey says, begin with the end in mind.

And finally, as far as Matasano goes. Yes, they have a good reputation. Thomas has a lot of technical depth for sure (certainly more than I). It interests me however, that I've never heard mention of a Needham-Schroeder implementation from them. But I may just have missed it. To be clear, I have no delusions - I imagine Matasano's crew has a lot more brain than I do. That's cool. And yet I find myself wondering why we (and they) all talk about which algorithm is good for crypto function x or y, but never about which protocol you might use to securely exchange keys (for example).