SMS

Auto Added by WPeMatico

Freedom Mobile server leak exposed customer data

Published May 7, 2019

A security lapse at Canada’s fourth largest cell network, Freedom Mobile, exposed customer data.

Security researchers Noam Rotem and Ran Locar found an Elasticsearch server leaking five million logs containing customer data. The server wasn’t protected with a password, allowing anyone to access the data.

Rotem and Locar, who shared their findings exclusively with TechCrunch and published a report at vpnMentor, said it took the cell giant a week to secure the leaking database after first reaching out.

The database is believed to be part of a logging system used by the company to determine errors and glitches in the company’s systems. The database recorded any errors and the plaintext data associated with it, including customer data.

Data seen by TechCrunch reveals customer names, email addresses, phone numbers, postal addresses, dates of birth, customer types and Freedom Mobile account numbers.

The logs also contain answers to credit checks filed through Equifax, including details if an application was accepted or rejected — along with the reason why.

We also found full credit card numbers, expiry dates and verification numbers stored in plaintext.

None of the data was encrypted.

Freedom Mobile has more than 1.5 million customers across Canada, according to its latest financial earnings. Chethan Lakshman, a spokesperson for Freedom Mobile’s parent company Shaw Communications, said about 15,000 customers were affected.

“We have discovered that the data that was exposed was contained to a very small number of customers who had opened or made any changes to their accounts at 17 Freedom Mobile retail locations from March 25 to April 15, and any customers who made changes or opened accounts on April 16,” he said. “Our investigation has revealed that a very limited amount of Freedom Mobile customer data was exposed as the result of a misconfigured server managed by Apptium, a new third-party service provider Freedom Mobile has engaged to streamline our retail customer support processes.”

A forensic investigation is underway, the spokesperson said.

Apptium did not return a request for comment.

It’s the latest in a string of data exposures following security lapses that failed to secure databases with basic security measures. Earlier this year, Rotem and Locar found Chinese online shopping giant Gearbest inadvertently exposed millions of customer orders. Now, the researchers say the Freedom Mobile data leak could be one of Canada’s largest. The closest was Bell Canada’s data breach in 2017, in which hackers took more than 1.9 million customer records.

Access to credit card data and credit score data would be a boon for fraudsters and identity thieves wanting to cash in.

A spokesperson for Canada’s data protection authority, the Office of the Privacy Commissioner, confirmed it “received a breach report related to Freedom Mobile,” and “will be examining the report in order to determine next steps.”

Read more:

Developers can now verify mobile app users over WhatsApp instead of SMS

Published April 30, 2019

Facebook today released a new SDK that allows mobile app developers to integrate WhatsApp verification into Account Kit for iOS and Android. This will allow developers to build apps where users can opt to receive their verification codes through the WhatsApp app installed on their phone instead of through SMS.

Today, many apps give users the ability to sign up using only a phone number — a now popular alternative to Facebook Login, thanks to the social network’s numerous privacy scandals that led to fewer people choosing to use Facebook with third-party apps.

Plus, using phone numbers to sign up is common with a younger generation of users who don’t have Facebook accounts — and sometimes barely use email, except for joining apps and services.

When using a phone number to sign in, it’s common for the app to confirm the user by sending a verification code over SMS to the number provided. The user then enters that code to create their account. This process can also be used when logging in, as part of a multi-factor verification system where a user’s account information is combined with this extra step for added security.

While this process is straightforward and easy enough to follow, SMS is not everyone’s preferred messaging platform. That’s particularly true in emerging markets like India, where 200 million people are on WhatsApp, for example. In addition, those without an unlimited messaging plan are careful not to overuse texting when it can be avoided.

That’s where the WhatsApp SDK comes in. Once integrated into an iOS or Android app, developers can offer to send users their verification code over WhatsApp instead of text messaging. They can even choose to disable SMS verification, notes Facebook.

This is all a part of WhatsApp’s Account Kit, which is a larger set of developer tools designed to allow people to quickly register and log in to apps or websites using only a phone number and email, no password required.

This WhatsApp verification codes option has been available on WhatsApp’s web SDK since late 2018, but hadn’t been available with mobile apps until today.

After account hacks, Twitch streamers take security into their own hands

Published April 30, 2019

Twitch has an account hacking problem.

After the breach of popular browser game Town of Salem in January, some 7.8 million stolen passwords quickly became the weakest link not only for the game but gamers’ other accounts. The passwords were stored using a long-deprecated scrambling algorithm, making them easily cracked.

It didn’t take long for security researcher and gamer Matthew Jakubowski to see the aftermath.

In the weeks following, the main subreddit for Amazon-owned game streaming site Twitch — of which Jakubowski is a moderator — was flooded with complaints about account hijacks. One after the other, users said their accounts had been hacked. Many of the hijacked accounts had used their Town of Salem password for their Twitch account.

Jakubowski blamed the attacks on automated account takeovers — bots that cycle through password lists stolen from breached sites, including Town of Salem.

“Twitch knows it’s a problem — but this has been going on for months and there’s no end in sight,” Jakubowski told TechCrunch.

Credential stuffing is a security problem that requires participation from both tech companies and their users. Hackers take lists of usernames and passwords from other breached sites and brute-force their way into other accounts. Customers of DoorDash and Chipotle have in recent months complained of account breaches, but have denied their systems have been hacked, offered little help to their users or shown any effort to bolster their security, and instead washed their hands of any responsibility.

Jakubowski, working with fellow security researcher Johnny Xmas, said Twitch no longer accepting email addresses to log in and incentivizing users to set up two-factor authentication would all but eliminate the problem.

The Russia connection

In new research out Tuesday, Jakubowski and Xmas said Russian hackers are a likely culprit.

The researchers found attackers would run massive lists of stolen credentials against Twitch’s login systems using widely available automation tools. With no discernible system to prevent automated logins, the attackers can hack into Twitch accounts at speed. Once logged in, the attackers then change the password to gain persistent access to the account. Even if they’re caught, some users are claiming a turnaround time of four weeks for Twitch support to get their accounts back.

On the accounts with a stored payment card — or an associated Amazon Prime membership — the attackers follow streaming channels they run or pay a small fee to access, of which Twitch takes a cut. Twitch also has its own virtual currency — bits — to help streamers solicit donations, which can be abused by the attackers to funnel funds into their coffers.

When the attacker’s streaming account hits the payout limit, the attacker cashes out.

The researchers said the attackers stream prerecorded gameplay footage on their own Twitch channels, often using Russian words and names.

“You’ll see these Russian accounts that will stream what appears to be old video game footage — you’ll never see a face or hear anybody talking but you’ll get tons of people subscribing and following in the channel,” said Xmas. “You’ll get people donating bits when nothing is going on in there — even when the channel isn’t streaming,” he said.

This activity helps cloak the attackers’ account takeover and pay-to-follow activity, said Xmas, but the attackers would keep the subscriber counts low enough to garner payouts from Twitch but not draw attention.

“If it’s something easy enough for [Jakubowski] to stumble across, it should be easy for Twitch to handle,” said Xmas. “But Twitch is staying silent and users are constantly being defrauded.”

Two-factor all the things

Twitch, unlike other sites and services with a credential stuffing problem, already lets its 15 million daily users set up two-factor authentication on their accounts, putting much of the onus to stay secure on the users themselves.

Twitch partners, like Jakubowski, and affiliates are required to set up two-factor on their accounts.

But the researchers say Twitch should do more to incentivize ordinary users — the primary target for account hijackers and fraudsters — to secure their accounts.

“I think [Twitch] doesn’t want that extra step between a valid user trying to pay for something and adding friction to that process,” said Jakubowski.

“The hackers have no idea how valuable an account is until they log in. They’re just going to try everyone — and take a shotgun approach.”
Matthew Jakubowski, security researcher and Twitch partner

“Two-factor is important — everyone knows it’s important but users still aren’t using it because it’s inconvenient,” said Xmas. “That’s the bottom line: Twitch doesn’t want to inconvenience people because that loses Twitch money,” he said.

Recognizing there was still a lack of awareness around password security and with no help from Twitch, Jakubowski and Xmas took matters into their own hands. The pair teamed up to write a comprehensive Twitch user security guide to explain why seemingly unremarkable accounts are a target for hackers, and hosted a Reddit “ask me anything” to let users to ask questions and get instant feedback.

Even during Jakubowski’s streaming sessions, he doesn’t waste a chance to warn his viewers about the security problem — often fielding other security-related questions from his fans.

“Every 10 minutes or so, I’ll remind people watching to set-up two factor,” he said.

“The hackers have no idea how valuable an account is until they log in,” said Jakubowski. “They’re just going to try everyone — and take a shotgun approach,” he said.

Xmas said users “don’t realize” how vulnerable they are. “They don’t understand why their account — which they don’t even use to stream — is desirable to hackers,” he said. “If you have a payment card associated with your account, that’s what they want.”

Carrot and the stick

Jakubowski said that convincing the users is the big challenge.

Twitch could encourage users with free perks — like badges or emotes — costing the company nothing, the researchers said. Twitch lets users collect badges to flair their accounts. World of Warcraft maker Blizzard offers perks for setting up two-factor, and Epic Games offers similar incentives to their gamers.

“Rewarding users for implementing two-factor would go a huge way,” said Xmas. “It’s incredible to see how effective that is.”

The two said the company could also integrate third-party leaked credential monitoring services, like Have I Been Pwned, to warn users if their passwords have been leaked or exposed. And, among other fixes, the researchers say removing two-factor by text message would reduce SIM swapping attacks. Xmas, who serves as director of field engineering at anti-bot startup Kasada — which TechCrunch profiled earlier this year — said Twitch could invest in systems that detect bot activity to prevent automated logins.

Twitch, when reached prior to publication, did not comment.

Jakubowski said until Twitch acts, streamers can do their part by encouraging their viewers to switch on the security feature. “Streamers are influencers — more users are likely to switch on two-factor if they hear it from a streamer,” he said.

“Getting more streamers to get on board with security will hopefully go a much longer way,” he said.

Read more:

The consumer version of BBM is shutting down on May 31

Published April 18, 2019

It might be time to move on from BBM. The consumer version of the BlackBerry Messenger will shut down on May 31. Emtek, the Indonesia-based company that partnered with BlackBerry in 2016, just announced the closure. It’s important to note, BBM will still exist and BlackBerry today revealed a plan to open its enterprise-version of BBM to general consumers.

Starting today, BBM Enterprise will be available through the Google Play Store and eventually from the Apple App Store. The service will be free for one year and after that, $2.49 for six months of service. This version of the software, like the consumer version, still features group chats, voice and video calls and the ability to edit and retract messages.

As explained by BlackBerry, BBMe features end-to-end encryption:

BBMe can be downloaded on any device that uses Android, iOS, Windows or MAC operating systems. The sender and recipient each have unique public/private encryption and signing keys. These keys are generated on the device by a FIPS 140-2 certified cryptographic library and are not controlled by BlackBerry. Each message uses a new symmetric key for message encryption. Additionally, TLS encryption between the device and BlackBerry’s infrastructure protects BBMe messages from eavesdropping or manipulation.

BBM is one of the oldest smartphone messaging services. Research in Motion, BlackBerry’s original name, released the messenger in 2005. It quickly became a selling point for BlackBerry devices. BBM wasn’t perfect and occasionally crashed, but it was a robust, feature-filled messaging app when most of the world was still using SMS. Eventually, with the downfall of RIM and eventually BlackBerry, BBM fell behind iMessage, WhatsApp and other independent messaging platforms. Emtek’s partnership with BlackBerry was supposed to bring the service into the current age, but some say the consumer version ended up bloated with games, channels and ads. BlackBerry’s BBMe lacks a lot of those extra features, so consumers might find it a better platform for communicating.

YC alum Keeper raises $1.6M to help gig workers pay taxes

Published April 15, 2019

Every year around this time, Uber drivers, Wag dog walkers, Bird scooter chargers, social media influencers and other gig economy workers face the unsightly challenge of paying their taxes.

Companies like Uber and Lyft classify their drivers as independent contractors, which means you aren’t given any benefits and the company doesn’t withhold any of your taxes. This puts gig workers in a tough position come tax day, especially if they aren’t prepared to shell out big sums to the IRS.

Keeper, a startup that’s just graduated from the Y Combinator startup accelerator, is here to make taxes a lot easier for that demographic and to save them as much money as possible.

Founded by childhood buddies and former debate partners Paul Koullick and David Kang, the San Francisco-based company has raised $1.65 million on a $10 million valuation in a round led by Jake Jolis of Matrix Partners.

Keeper co-founders Paul Koullick (left) and David Kang

The pair entered YC this winter with a big idea and little to show for it. Come March, they had developed a full-fledged product and accumulated 200 paying customers. With their first round of funding, they plan to add to their small but growing team and acquire 10,000 customers in the next 18 months.

“There are some companies that are trying to go very broad and trying to cover the whole spectrum of benefits; we’re just trying to go really deep on taxes,” Kang told TechCrunch. “This is a pain point. This is where people are definitely leaving the most money on the table.”

Keeper guesses the average gig worker in the U.S. is overpaying their taxes by more than 20 percent, or about $1,550 for those making more than $25,000 per year. Why? Because these independent contractors aren’t claiming the tax write-offs available to them, like phone bills, car maintenance fees and even a Spotify subscription for drivers.

“If you’re a dog walker, there are so many things you need to be writing off, like your poop bags, your extra leashes, your parking,” Koullick told TechCrunch. “This population needs the guidance of an accountant, but they can’t afford one and we’re trying to create this third option.”

Like a personal accountant, Keeper monitors gig workers’ expenses all year in search of possible tax deductions, saving each user $173 per month on average, it estimates. The startup uses Plaid to follow its customers’ transaction history, and once per day sends a text message asking if there are any tax write-offs to note. Over time, it gets smarter and smarter, keeping the SMS questions to a minimum.

Keeper doesn’t fully file taxes for 1099 workers yet, but will begin offering a quarterly tax filing service in June. Next year, it plans to offer a full-year tax-filing service.

Koullick, Keeper’s chief executive officer, worked in product at Square before joining another startup, called Stride, where he built and scaled Stride Tax, a mileage and expense-tracking app. Kang, for his part, has spent most of his post-graduate career at a trading firm in Chicago, focused on quantitative modeling. The two toyed with a few startup ideas before landing on Keeper’s tax business.

“We wanted to build something that actually mattered to real people,” Koullick explained. “And we wanted to do it in the financial space where we were happy to wade through ugly details and systems on their behalf.”

Keeper isn’t the only recent YC alum focused on the growing gig economy. Another, Catch, sells health insurance, retirement savings plans and tax-withholding services directly to freelancers, contractors or anyone uncovered. Given the rapid rise of Uber and other gig platforms, it’s no wonder YC startups are tapping into the various business opportunities available there.

“We’re willing to tackle some of these topics that are kind of boring and mundane and really intensive,” Kang added. “Like the average person doesn’t want to think about taxes or filling out forms. We saw that as an opportunity for us to step in and be like, hey, we’ll take it.”

Gig workers need health & benefits — Catch is their safety net

Google starts pulling unvetted Android apps that access call logs and SMS messages

Published January 18, 2019

Google is removing apps from Google Play that request permission to access call logs and SMS text message data but haven’t been manually vetted by Google staff.

The search and mobile giant said it is part of a move to cut down on apps that have access to sensitive calling and texting data.

Google said in October that Android apps will no longer be allowed to use the legacy permissions as part of a wider push for developers to use newer, more secure and privacy minded APIs. Many apps request access to call logs and texting data to verify two-factor authentication codes, for social sharing, or to replace the phone dialer. But Google acknowledged that this level of access can and has been abused by developers who misuse the permissions to gather sensitive data — or mishandle it altogether.

“Our new policy is designed to ensure that apps asking for these permissions need full and ongoing access to the sensitive data in order to accomplish the app’s primary use case, and that users will understand why this data would be required for the app to function,” wrote Paul Bankhead, Google’s director of product management for Google Play.

Any developer wanting to retain the ability to ask a user’s permission for calling and texting data has to fill out a permissions declaration.

Google will review the app and why it needs to retain access, and will weigh in several considerations, including why the developer is requesting access, the user benefit of the feature that’s requesting access and the risks associated with having access to call and texting data.

Bankhead conceded that under the new policy, some use cases will “no longer be allowed,” rendering some apps obsolete.

So far, tens of thousands of developers have already submitted new versions of their apps either removing the need to access call and texting permissions, Google said, or have submitted a permissions declaration.

Developers with a submitted declaration have until March 9 to receive approval or remove the permissions. In the meantime, Google has a full list of permitted use cases for the call log and text message permissions, as well as alternatives.

The last two years alone has seen several high-profile cases of Android apps or other services leaking or exposing call and text data. In late 2017, popular Android keyboard ai.type exposed a massive database of 31 million users, including 374 million phone numbers.

Another huge database exposed millions of call logs and SMS text messages

The Infatuation raises $30M from Jeffrey Katzenberg’s WndrCo to bring Zagat into the digital age

Published September 27, 2018

WndrCo, the consumer tech investment and holding company founded by longtime Hollywood executive Jeffrey Katzenberg, has invested $30 million in The Infatuation, a restaurant discovery platform.

The Infatuation made waves earlier this year when it purchased Zagat from Google, which had paid $151 million for the 40-year-old company in 2011. Despite efforts to makeover the Zagat app, the search giant ultimately decided to unload the perennial restaurant review and recommendation service and focus on expanding its database of restaurant recommendations organically.

New York-based The Infatuation was founded by music industry vets Chris Stang and Andrew Steinthal in 2009. It has previously raised $3.5 million for its mobile app, events, newsletter and personalized SMS-based recommendation tool.

Stang told TechCrunch this morning that they plan to use a good chunk of the funds to develop the new Zagat platform, which will be kept separate from The Infatuation.

“The first thing we want to do before we build anything is spend a lot of time researching how people have used Zagat in the past, how they want to use it in the future, what a community-driven platform could look like and how to apply community reviews and ratings to the brand,” said Stang, The Infatuation’s chief executive officer. “Zagat’s roots are in user-generated content. … What we are doing now is thinking through what that looks like with new tech applied to it. What it looks like in the digital age. How [we can] take our domain expertise and that legendary brand and make something new with it.”

The Infatuation will also expand to new cities beginning this fall with launches in Boston and Philadelphia. It’s already active in a dozen or so U.S. cities including Los Angeles, Seattle and San Francisco. The startup’s first and only international location is London.

Jeffrey Katzenberg’s NewTV closes a billion-dollar round, says report

Katzenberg, who began his Hollywood career at Paramount Pictures, began raising up to $2 billion for WndrCo about a year ago. Since then, he’s unveiled WndrCo’s new mobile video startup NewTV, which has raised $1 billion and hired Meg Whitman, the former president and CEO of Hewlett Packard, as CEO.

On top of that, WndrCo has invested in Mixcloud, Axios, Node, Flowspace, Whistle Sports, TYT Network and others.

Given The Infatuation founders’ experience in the entertainment industry, a partnership with Katzenberg was natural.

“We really felt like between content and technology they had … expertise on both sides,” Stang said. “The Infatuation is at its best when great content intersects with great technology, to find a fund that was perfectly suited to that was exciting.”

Meet the startups in the latest Alchemist class

Published September 20, 2018

Alchemist is the Valley’s premiere enterprise accelerator and every season they feature a group of promising startups. They are also trying something new this year: they’re putting a reserve button next to each company, allowing angels to express their interest in investing immediately. It’s a clever addition to the demo day model.

You can watch the live stream at 3pm PST here.

Videoflow – Videoflow allows broadcasters to personalize live TV. The founding team is a duo of brothers — one from the creative side of TV as a designer, the other a computer scientist. Their SaaS product delivers personalized and targeted content on top of live video streams to viewers. Completely bootstrapped to date, they’ve landed NBC, ABC, and CBS Sports as paying customers and appear to be growing fast, having booked over $300k in revenue this year.

Redbird Health Tech – Redbird is a lab-in-a-box for convenient health monitoring in emerging market pharmacies, starting with Africa. Africa has the fastest growing middle class in the world — but also the fastest growing rate of diabetes (double North America’s). Redbird supplies local pharmacies with software and rapid tests to transform them into health monitoring points – for anything from blood sugar to malaria to cholesterol. The founding team includes a Princeton Chemical Engineer, 2 Peace Corps alums, and a Pharmacist from Ghana’s top engineering school. They have 20 customers, and are growing 36% week over week.

Shuttle – Shuttle is getting a head start on the future of space travel by building a commercial spaceflight booking platform. Space tourism may be coming sooner than you think. Shuttle wants to democratize access to the heavens above. Founded by a Stanford Computer Science alum active in Stanford’s Student Space Society, Shuttle has partnerships with the leading spaceflight operators, including Virgin Galactic, Space Adventures, and Zero-G. Tickets to space today will set you back a cool $250K, but Shuttle believes that prices will drop exponentially as reusable rockets and landing pads become pervasive. They have $1.6m in reservations and growing.

Birdnest – Threading the needle between communal and private, Birdnest is the Goldilocks of office space for startups. Communal coworking spaces are accessible but have too many distractions. Traditional office spaces are private but inflexible on their terms. Birdnest brings the best of each without the drawbacks: finding, leasing, and operating a network of underutilized spaces inside of private offices. The cofounders, a duo of Duke and Kellogg MBA grads, are at $300K ARR with a fast-growing 50+ client waitlist.

Tag.bio – Tag.bio wants to make data science actionable in healthtech. The founding team is comprised of a former Ayasdi bioinformatician and a former Honda Racing engineer with a Stanford MBA. They’ve developed a next-generation data science platform that makes it easy and fast to build data apps for end users, or as they say, “WordPress for data science.” The result they claim is lightning-fast analysis apps that can be run by end users, dramatically accelerating insight discovery. They count the UCSF Medical Center and a “large Swiss pharma company” as early customers.

nCorium – They’ve built a new server architecture to handle the onslaught of AI to come with what they claim is the world’s first AI accelerator on memory to deliver 30x greater performance than the status quo. The quad founding team is intimidatingly technical — including a UCSD Professor, and former engineers from Qualcomm and Intel with 40 patents among them. They have $300K in pilots.

Spiio – Software eats landscaping with Spiio, which combines cloud-driven AI with physical sensors to monitor watering and landscaping for big companies. Their smart system knows when to water and when not to. This reduces water consumption by 50%, which means their system pays for itself in less than 30 days for big companies. They want to connect every plant to the internet, and look like they are off to a good start — $100K in orders from brand name Valley tech firms, and they are doubling monthly.

Element42 – Fraud is a major problem — For example, if you buy a Rolex on eBay, you run the risk of winding up with a counterfeit. Started by ex-VPs from Citibank, the founders are using risk models and technologies that banks use to help brands combat fraud and counterfeiting. Designed with token economics, they also incentivize customers to buy genuine products by serving exclusive content and promotions only to genuine product holders. Built on blockchain at the core, they claim to be the world’s first peer-to-peer authentication platform for physical assets. They have 45 customers across two industry verticals, 800K in ARR and are a member of World Economic Forum’s global initiatives against corruption.

My90 – Distrust between the public and the police has rarely been more strained than it is today. My90 wants to solve that by collecting data about interactions between the police and the public—think traffic stops, service calls, etc.—and turn these into actionable intelligence via an online analytics dashboard. Users text My90 anonymously about their interactions, and My90’s dashboard analyzes the results using natural language processing. Customers include major city police departments like the San Jose Police Department and the world’s largest community policing program. They have booked $150K in pilots and are expanding aggressively across the US.

Nunetz – A Stanford Computer Science grad and UCSF Neurosurgeon have come together to try to build a single unifying interface to replace the deluge of monitors and data sources in today’s clinical health environment. The goal is to prepare a daily “battle map” for physicians, nurses, and other providers, with an initial focus on the Intensive Care Unit (ICU). They have closed 3 paid pilots with hospitals through grants.

When Labs – If you hate managing people, When Labs wants to unburden you. Using an AI-powered assistant that texts with employees to negotiate assignments for hourly work, WhenLabs is trying to free customers like Hilton from spending money on managers who would normally do this manually. As the system gets smarter, they claim employees will prefer interfacing with their AI bot more than a human. AI and HR is a crowded space, but this might be the team to separate from the pack: the founding team’s previous company had a 9 figure exit to IBM.

FirstCut – FirstCut helps businesses put video content out at scale. Video dominates social media — it creates 10x more comments than text — and is emerging as a necessity for B2B media. But putting video out if you are a B2B marketer normally requires using agencies that charge hefty fees. FirstCut wants to disrupt the agencies with software and marketplaces. They use software automation and an on-demand talent marketplace to offer a fixed price product for video content. They are at $180k revenue, and most of it is moving to recurring subscriptions.

LynxCare – LynxCare claims that 90% of healthcare data goes untapped when doctors make critical decisions about your life. Further, they claim the average person’s life could be extended by 4 years if that data can be converted into insights. Their team of clinicians and data scientists aims to do just that — building a data platform that aggregates disparate data sets and drive insight for better clinical outcomes. And it looks like their platform has fans: they are active in 9 hospitals, count Pharma companies like Pfizer as Partners, and grew 4x over the past year and now are at $800K ARR.

ADIAN – Adian is a B2B SaaS product that digitizes the complex agrochemical supply chain in order to improve the sales process between manufacturers and distributors. The company claims manufacturers reduce costs by 20% and increase sales by 4% by using their online framework. $1.5 Billion and 70,000 orders have gone through the platform to date.

Hardin Scientific – Hardin is building IoT-enabled, Smart Lab Equipment. The hardware becomes a gateway to become the hub for monitoring, controlling, and sharing scientific data across teams. They’ve closed over $1.5m in revenue, and raised $15m in equity and debt financing. One of their smart devices is being used to 3D print bio-tissues and human organs in space.

ZaiNar – This team of 5 Stanford grads — 3 PhD’s and 2 MBAs — joined up with the Co-Founder of BlueKai to build the world’s best time synchronization technology. ZaiNar claims their ability to wirelessly synchronize and distribute time between networked devices is a thousand times better than existing technologies. This enables them to locate RF-emitting devices (i.e. phones, cars, drones, & RFID) at long distances with sub-meter accuracy. Beyond location, this technology has applications across data transmission, 5G communications, and energy grids. ZaiNar has raised a $1.7 million seed from AME Cloud and Softbank, and has built an extensive patent portfolio.

SMART Brain Aging – This startup claims to reduce the onset of dementia by 2.25 years with software. They are the only company approved by Medicare to get reimbursed on a preventative basis for the treatment of dementia. In conjunction with Harvard University, they have developed 20,000 exercises that are clinically proven to reduce the onset of dementia and, they claim, help build neurotransmitters. The company works with 300 patients per week ($2.2 million annual revenue) and is building to a goal of helping 22,000 people in 24 months.

Phoneic – Phoneic believes the data trapped in voice calls from cellphones is a gold mine waiting to be unleashed. Their app records and transcribes cell phones conversations, and the company has built an integration layer to enterprise AI and CRM systems that traditionally didn’t have access to voice data. The team is led by the co-founder of 3jam, one of the first group SMS and virtual number companies, which was acquired by Skype in 2011. He is keenly aware of the power of virality — and like Skype, the use of Phoneic spreads its adoption. The company has already raised $800,000 in seed funding.

Arkose Labs – Whether or not you think Russia interfered with the 2016 election, it’s no secret that bots are having significant impact on society. Arkose Labs wants to fight fraud, without adding friction to legit users. Most fraud prevention platforms today focus on gathering info from the user and providing a probability score that the traffic is good or bad. This leaves companies with a difficult decision where they may be blocking revenue generating users. Arkose has a different approach, and uses a bilateral approach that doesn’t force this tradeoff. They claim to be the only solution to offer a 100% SLA on fraud prevention. Big companies like Singapore Airlines and Electronic Arts are customers. USVP led a $6 million investment into the company.

Epic Games just gave a perk for folks to turn on 2FA; every other big company should, too

Published August 24, 2018

Let’s talk a bit about security.

Most internet users around the world are pretty crap at it, but there are basic tools that companies have, and users can enable, to make their accounts, and lives, a little bit more hacker-proof.

One of these — two-factor authentication — just got a big boost from Epic Games, the maker of what is currently The Most Popular Game In The World: Fortnite.

Fortnite players can unlock a new emote if they enable two-factor authentication

Epic is already getting a ton of great press for what amounts to very little effort.

Son: Do you know what two-factor authentication is?
Me: Uh, yeah?
Son: I get a free dance on @Fortnitegame if I enable two factor. Can we do that?

Incentives matter.

— Dennis (@DennisF) August 23, 2018

The company is giving users a new emote (the victory dance you’ve seen emulated in airports, playgrounds and parks by kids and tweens around the world) to anyone who turns on two-factor authentication. It’s one small (dance) step for Epic, but one giant leap for securing their users’ accounts.

The thing is any big company could do this (looking at you Microsoft, Apple, Alphabet and any other company with a huge user base).

Apparently the perk of not getting hacked isn’t enough for most users, but if you give anyone the equivalent of a free dance, they’ll likely flock to turn on the feature.

It’s not that two-factor authentication is a panacea for all security woes, but it does make life harder for hackers. Two-factor authentication works on codes, basically tokens, that are either sent via text or through an over-the-air authenticator (OTA). Text messaging is a pretty crap way to secure things, because the codes can be intercepted, but OTAs — like Google Authenticator or Authy — are sent via https (pretty much bulletproof, but requiring an app to use).

So using SMS-based two-factor authentication is better than nothing, but it’s not Fort Knox (however, these days, even Fort Knox probably isn’t Fort Knox when it comes to security).

Still, anything that makes things harder for crimes of opportunity can help ease the security burden for companies large and small, and the consumers and customers that love them (or at least are forced to pay and use them).

I’m not sure what form the perk could or should take. Maybe it’s the promise of a free e-book or a free download or an opportunity to have a live chat with the celebrity, influencer or athlete of a user’s choice. Whatever it is, there’re clearly something that businesses could do to encourage greater adoption.

Self-preservation isn’t cutting it. Maybe an emote will do the trick.

CallPage lets you call your website visitors

Published July 31, 2018

Poland-based CallPage offers something other customer interaction apps don’t: the ability to call your website visitors as soon as they click on your page. In a world where the difference between a sale and a click past your site onto Facebook, this is a pretty cool little feature.

CallPage began in 2015 when the founders, Ross Knap, Sergey Butko, and Andrew Tkachiv, tried to figure out why website visitors would leave their sites. They started out as a consultancy and the product was born out of some after-hours tinkering by the team. Instead of messaging users, they thought, why not let managers talk to them on the phone?

“Our widget analyzes user behavior on your website,” said CEO Knap. “Then when it sees an interested visitor, it offers him a free callback in 28 seconds. The interested visitor leaves a phone number on your site, our widget calls to the first available manager’s mobile phone and then the next one if no one picks up. After the conversation client will receive an SMS of thanks. It doesn’t require any extra work.”

The team raised a $4.5 million Series A from TDJ Pitango Ventures, Innovation Nest, and Market One Capital. They have 3,000 customers and it makes 280,000 calls monthly. The team started with a $50,000 seed check from an early investor.

Knap and the team have big plans.

“CallPage will continue the realization of our development plan,” said Knap. “The company is going to change into a product more from the perspective of ‘All your company calls in one place.’ The R&D department have already started working on using machine learning and AI which allows analyzing of hundreds of thousands of calls through the CallPage system. Thanks to this, companies will be able to run their communications more effectively.”