All right, we are live and we are good. Hello, my people. Welcome to the Score Channel. It's a pleasure to see you again. I'm gonna give you tips today to help you crush the speaking part of the dual lingo test. Trust me, if you apply these tips, your score will improve. I can 100% guarantee it. Like, it's not just about your speaking ability. It's about how you approach a test. That's two different things. There's test skills and there's English skills. So if you've been using your English skills to the max and you're still not getting higher scores, maybe this stuff will help you. I can't make you a better English speaker overnight, but I can show you how to use the test to your advantage and how to really work the different exercises that it asks you to do. We're gonna be going through three different types of exercises because that's what you see on the dual lingo test. They got three basic speaking tasks. The first ones ask you to describe images. The second one will give you a written prompt that you have to then answer and develop.  Okay, so we're gonna go through all three of those today and I'm gonna show you how it goes. Now, if you're rewatching this, if I make a super cut of this later or you're watching this whole live thing later, I would recommend that once I show you a new task or once you hear the audio for the task, you pause and try to do it yourself, okay? And then you can hear how I do it.  The images, okay? And I'm gonna give you a little formula that you can use to handle image descriptions. All right, it's very straightforward, okay? Just remember dad, that's all you gotta do, okay? Dad, I don't have one, but it's fine, doesn't bother me. Dad is an acronym, stands for three things. First, describe, okay?  Then we're gonna analyze, okay? We're gonna go a little bit deeper and start asking why. Why are these things happening? Finally, I wanna develop this stuff, okay? So that's the D-A-D, that's dad. Describe, analyze, and develop. Develop means that you're gonna speculate. You're gonna think about what might happen, what could happen, okay? What are the possibilities? Again, this shows off other English structures. It shows off your other skills. All right, let's do it. All right, I'm gonna start my timer. I'm gonna start by describing. Boy's projection, Franco, exactly. Okay, so I wanna start by describing this picture. So in this picture, we see, looks like two guys and a younger person in a boat, it's a wooden boat on maybe a lake or a big river. This is a cloudy day, it's kinda hard to see where we are, but it looks like it could be the jungle. It's very remote, there's no civilization here, and I can see that there's just green in the background, some foliage, some trees, but that's about it. It's just gray water, gray skies and trees. The boat is pretty small, it seems, that maybe it could hold six or seven people, but right now there's these three here, and there's the guy in the back operating a motor, and looks like the guy in the middle, who happens to look a lot like yours truly, is holding a beer, and so these guys might be tourists. They could be here to explore this area. They kinda look like tourists because these two guys look pretty different from the guy in the back. So I think that they probably came here to explore, go on an adventure, and maybe these two guys are friends or brothers that are traveling together and just wanted to go to somewhere new and see something different. It looks like they're having a good time, like they seem to be having fun, they're smiling and enjoying their trip, and obviously you're gonna have more fun if you have a beer in your hands, so that's cool. And it seems like a relatively cool place to go. It's hard to say exactly where they might be going. Maybe they're heading to some other location in the jungle for like a walk, or maybe they're going back to a lodge or a resort where they're gonna stay for the night. I don't know exactly where they're going here, but it looks like they're having a good time doing it. Let's see what we got. Okay, in this picture I see a man and a woman, they seem to be talking. It's hard to tell what kind of conversation this is. I think it could be an argument because she's pointing to herself and she looks like she's a little bit upset. And the man's posture, he's got his arms folded and he doesn't seem to be smiling or too happy, so maybe they're having a fight or an argument. However, the location is very nice and pretty. Like I see a lot of flowers in the background, I see a lot of trees in the background, and there's a bag there also in the middle of the picture that says Tamboleta Cama, so maybe this is like a restaurant or like a touristy place and they bought something there. So maybe these two are a couple and they could be visiting this place together and maybe they're talking about their experience at this place or they're discussing some issue that they had on this part of the trip. I also can tell that like these two probably traveled together, but I can see that they seem to be carrying bags. I can see the girl has a bag over her shoulder and given he does also, they're probably travelers or tourists. So I don't know exactly where this could be, but I also see in the background something that looks like a machine that's like maybe presses down on stuff. So maybe this is like a vineyard or a winery or like some sort of distillery or something that could be because I see that corkscrew-shaped thing in the back and I don't know exactly what that's for, but it could be like an old press or something.  I would certainly like to spend a day here. You've got a lot of beautiful scenery and it could be a lot of fun. Okay, here we go. Okay, in this picture, it seems that we have a street that has some normal cars, but it also has go carts and we see like five or six red go carts in front of the other cars. And there are a lot of lights. This looks like a nighttime scene and there's some symbols on these signs. So maybe this is China or Japan based on the type of letters I see on the sign in the background and in the business back there. And then we see that the people in these carts are wearing some funny costumes. One of them looks like a Pikachu. Somebody else looks like Tigger from Winnie the Pooh. I don't know what these other ones are, but they're wearing like strange costumes or clothes and they look like they're having a lot of fun.  So I think that maybe this is some kind of activity you can do in this place. Like maybe you can rent go carts and do a tour around the city even though I wouldn't think you could do that because this is like a normal road and I didn't know go carts could drive on the same road. That seems weird. Maybe these guys are part of some sort of like tour group or a club that drives their go carts around. I don't know, but this looks like a lot of fun and it looks also like it's pretty safe because they don't seem very worried. They're not wearing any helmets. Like they must not be too concerned about getting hit by a car because they're just in the main street with go carts. So this looks like a lot of fun and I'm wondering if I can do this because this looks like a great time. I would like to try this. So in this picture, I see an older Japanese man. He's wearing a traditional blue robe, it seems. Underneath that, he has like a sweater and more common clothes. He's got two pairs of glasses. So that must help him see what he's doing really well. He's looks like he's painting a paper lantern. I think that's what those are. Those are paper lanterns, which are really traditional in Asia. And it looks like he also has on his desk some drawings or patterns that maybe he uses to copy those onto the lanterns. He also has some different pencils and pens and an eraser and some ink. So he seems to be applying the ink now directly to this paper lantern. I can see that he's very, very concentrated. Like he's really focused on what he's doing. His movement seems very deliberate and precise. He's again with two pairs of glasses, he must be really focused. He's really concentrated on what he's trying to do. So this could be his job. Maybe like this is what he does is he makes these paper lanterns and he sells them. So he wants them to be really good. Maybe this is something that he's just doing as a demonstration, like to show other people how to make these lanterns and what they're for. So I think that this is just something that is like a hobby for him and he probably does it and really feels good about doing it. I think this is something he obviously really likes to do because he seems very lost in what he's doing. Like almost like he's in a trance or in the zone. And I know that I get that way when I do creative stuff too. So I imagine he really enjoys this work and he probably can make some good extra money by selling those lanterns. I was gonna buy one, but I didn't know if I could bring it back safely.  They're very, very much the same as speaking part two of IELTS. If anybody's preparing for IELTS and they also wanna practice this part, this is it, like this is your moment, okay? Pay attention. If you guys are doing the duo-lingo, duo, I can't, I never can say it right. Duo-lingo English test. I always wanna say duo-inglish. I just wanna merge the words together. If you're doing the duo-lingo test, then they also have speaking parts that are identical to IELTS part two. And they're so identical that I literally just took IELTS prompts and put them in here. Like they're 100% the same. I'm gonna show you an example of one of these and show you how to do it, but it's very simple. All you gotta do is follow the points. They're gonna give you three or four things that you have to do. There's like a central command or prompt.  Very, very easy to do it. All you gotta do is follow the points and if you still have time, tell a story. That's it. Tell a story.  If you get cut off, it's okay. You don't have to have a perfectly neatly wrapped conclusion to finish this part of the test. Just talk, okay? Follow the points and then tell your story. Let's do this. Okay, so I'm gonna read this real quick. Describe an activity that you like to do in your free time, after work or study and you should say what you do, where you do it, when you do it, who you do it with. Explain why you like to do this activity. So I'm just gonna go through these points and I'm gonna tell a story at the end, okay? So something that I like to do after I finish work or whenever I have some free time is play Rocket League.  It's basically car soccer.  So it's a game that I play at home. Like I play it on my computer, sitting right here at my desk and I usually get to play Rocket League in the evenings, not every day of the week because I sometimes have way too much work to do but I try to play a little bit every week. Usually like Friday night is a good night for me to play Rocket League. Maybe like weekends during the day. So it depends on how much work I have to do and if I have like a lot of things to do then I don't play into anything but I try. I used to play this game all by myself. I never played with other people. I've always been like a solo gamer and then more recently I started playing with random people online. I would like play the game online and if I was connecting really well with somebody I started asking them to keep playing with me. And then I've actually got into a couple of groups on Discord which is like an app that people use to communicate when they play video games. So on Discord I get to like talk to these people live so we talk to each other, we tell jokes, we laugh while we're playing the game. I like to do it just because it's so challenging. Like it's a game where you could spend thousands of hours and still not be good and there's still people better than you that can do more amazing things than you. Like I can think of times where I have pulled off these amazing highlight plays that just are incredible and mind blowing like this one time I hit this double tap off the backboard right into the goal as the time expired to win the game for my team and those moments are just so amazing. Like it's one of the best feelings in the world. Let's do another. Let's keep it going. I'm feeling it. I'm on a roll. All right, describe a problem that affects the environment in the area where you live. So a major problem that affects my area which is Lima, Peru, I believe is littering or when people throw trash into the street instead of putting it in a trash can or disposing of it correctly. Littering I think is a major issue in Peru. There are several reasons why it's a big problem here. I think that one of the causes is just people not caring. I think a lot of people have a bad education. They don't think that it's a problem and they also assume that someone else will take care of it because there are people that the city pays to clean up the streets, you know? And you can see these people very early in the morning at six in the morning, sweeping the street and picking up trash.  And so I think that's why a lot of people don't feel like it's a big problem. I think a lot of people just assume that it's normal to do that. And so I think that that's the main cause and I think that's the reason why a lot of people don't like it, but then there's also a lot of people that feel like it's not an issue. And so they keep perpetuating the problem. So I think that there's a few things that need to be done to solve this. First of all, I think we should really punish people hard when they do this because they will do it very openly. I've seen people sitting at a red light just throw a cup outside the window and nobody does anything. And I think that as a society, we should start by being like responsible.   And it's like, no, you wanna throw stuff in the street? I throw it on you, okay? And then like, you know, I think we should have the police punishing these people way more severely. There should be fines, there should be penalties for people who do this. I think you should lose your license if you keep throwing trash out of your window. It's unacceptable behavior. And in my opinion, the only way to get it done is to like, you know, eliminate people with punishments. One more, I got one more of these, let's go. Describe an object you own that is important to you, okay? So I don't have a lot of important possessions. I have things that obviously are very important to like my day-to-day life and my work, but there's one thing in particular that is very important to me, and that is my gavel right here. This is the award you get when you win Best Delegate in a Model United Nations Conference. And I received it when I won Harvard National, Model United Nations Latin America 2018. And so this was given to me by the director after I won that competition. And that was an extremely satisfying moment. I don't use this really. I don't like bring this out very often. I do sometimes to show off and show people like, hey, I got a masito, I got a gavel deal with it. But I generally just keep it right here in my desk and it's here at all times not for any real reason just because it's important to me. And it's important to me because there's a couple reasons. One is it reflects the hard work that I put in for that event. Like I busted my butt to really win that event. It was probably the hardest I've ever prepared for anything ever. And I spent the better part of four days doing this event and working really hard and staying up all night to get the win. And it felt really good to get that win. And also because the year before that, I went to an MUN event and it didn't work out well. I got kicked out of the conference and it was one of the worst experiences ever. So for me to get this the year after that happened was like so significant for me. It was just one of those moments where I felt like justice had been served. I went from being the delegate that was expelled from a conference to being the best in the conference. And that was a pretty wild moment. And it was also really nice because a lot of cool people were there supporting me and I'll never forget it. Boom. The Duolingo test has the same kind of exercise. It has an exercise where you get an audio and answer a question and that's it, okay? You can replay the audio twice. It will start playing when you advance to that question. So let's say you were doing a writing task and you just finished your writing task and then you hit next, it will start playing that audio immediately on the Duolingo test.  So you're gonna need to hear it again. I would recommend listening to it again before you start. The thing to understand is that you can only record your answer once. So if you start hitting record, that's it. You can't go back and hear the audio again. You can't stop in the middle and be like, oh, wait, I should have listened to that again. Let me do that. Now, that's it. Like once you hit record, you are locked in. On the TOEFL, you don't even get to replay the audio. But it doesn't start right away. So you just, when you're ready, you hit the button, you hear it once, you answer the question. So in that sense, I think that Duolingo is actually easier because you can replay that audio before you record yourself. And the TOEFL is a little harder because you don't get that replay opportunity. You wanna define two to three ideas in your opening lines. Like kinda make a mental outline. It's gonna ask you for your opinion on something generally or what you think about something. So you're gonna wanna have two or three supporting reasons or ideas to talk about. And then you're gonna give an example for each one of those. Like you wanna say, this is my idea, plus here's an example. Could be from your personal experiences. Could be, you know, something you've seen on a movie or TV or whatever. Like that's the ideas. Ideas, examples. I can. Choose a place you go to often that is important to you and explain why it is important. All right, I got the sun lock. So a place that I go to that is important for me would probably be the Malecón y Miraflores. If there's a place that I would say I go to often, it would probably be that place. Especially the Parque del Amor. It's the love park as it's called in Spanish. And I like that spot because I used to go there from time to time with some friends and just hang out. And it's one of the places that I used to go to a lot when I first came to Peru. Like there was something about the place that brought me a lot of peace and tranquility. I have quite a few pictures of me in that place. When you get there, there's a mosaic. There's a mosaic wall that runs around the edge of the park. And it's the perfect height and shape. It's curved. You can sit there on it and just sit back and kind of look out at the sea and see the sunset. And that's really cool to me that you can just kind of sit back, watch the sunset or watch it rise. Just enjoy the ocean breeze and the smell of the sea and the warm air flying up. And the other reason it's really important to me is like I've spent some really cool moments with some very cool people there. There's some people who were very close to me who I've spent a lot of time with in this place. Even people who are guests who visit me or tourists that I meet, I take them there. I'm always like, just let's spend half an hour here because it's such a chill place. And it's really good for taking pictures. So I think that's the thing is like I've spent a lot of time there and every time I go back I feel the same sense of calm and peace and everybody who I take there enjoys it and it's always very memorable. So I think that's the place that I would consider important to me. What characteristics do you think makes someone a good parent? Explain why these characteristics are important to you. Okay, it's an interesting question. Here we go. All right, so again, I wanna have two or three ideas and kind of like structure my answer around those ideas. So I think good parents have a couple of key characteristics. First is that they have to be loving and genuinely interested in their children. But also I think they have to have a level of maturity that's really important. We often assume on that topic of maturity that just because someone's an adult, they're more mature. Just because they have kids, they're more mature. They're more responsible. But that's not necessarily true. Lots of people have kids unexpectedly. They have kids even though they didn't really want to or just because it was social pressure telling them that it was the right time to have kids or at their age they should have kids. And I think a lot of parents have children without really being emotionally ready to do that. I think they're not always mature. They're not always ready. And I think that that creates a lot of problems for their children. Like if somebody is going to bring a person into this world they should absolutely have their life organized and be ready and have their finances in order and things too. I don't think it's right to bring someone into the world only to give them a bad life. And I think that the love component obviously is like a mandatory component of being a parent. Like if you're gonna be a parent you need to love your kid. Everyone deserves to feel loved. Everyone deserves to have that kind of close relationship in their life and it's not right for someone to grow up without that. So I think those two things are really connected. Like if you're prepared and you're ready and you understand the commitment that is having a child then you probably will provide them with a loving environment and it will be a good experience for them growing up. If you're not ready, if you're not mature then you might still love your kid but you might not know how to show that love. You might not be ready for that. And I think that that is why I think love and maturity is like the two most important things for parents. Everything else you can figure out as you go. I'm gonna hear that. Imagine your life 10 years in the future. Talk about one way you think your life will be different in 10 years than it is now. All right, that's a pretty deep question. So 10 years in the future is kind of a scary thought because like a lot can happen in 10 years. I think the main difference in my life will probably be where I find myself. I expect myself to be traveling more in 10 years and to be in more places.  And I think that that's part of life that you have to sometimes work through some phases that take a lot of effort and you won't necessarily want to get up and go to work every single day. But I hope that like in 10 years from now I have more of that freedom. I think I'll have the freedom to travel more, to work from wherever I want to explore the world more and not be tied down necessarily to a day job because I see my company growing, I see my other options expanding and I see myself wanting to explore those options. And I think that once I have accumulated a little bit of wealth and capital and I've been able to like pay off this place, then I have that freedom to say, yeah, I can take a few months off of work. Yeah, I can go travel for a year. Yeah, I can go like run my business from somewhere else. Maybe for, you know, I'll spend a year in Japan and run my business there. I could do that. That's all stuff that could happen in 10 years. And I think that in order for that to happen, I have to really like work hard right now. Even the days I don't want to, even the moments where it's difficult because like that is the key is hard work. If you put in the hard work, you get the reward and then eventually, you know, you can get done early. I don't know that I'll be able to retire in 10 years, but I think I'll at least have a more dynamic, exciting life in 10 years because of the work that I'm putting in today. Again, thank you everybody for checking it out. And I hope you have a great day.


Thanks for checking out this episode of Brutal Battle Beer Break. I have just showered because I was at the gym working out and as per an article I read recently, thank you to Colin Norman, it was saying that beer is a really good thing to drink after a workout because of all the nutrients, nutrients, minerals and vitamins available in beer. So why not have a beer after my shower, after my workout? I'm going to do it. What I have today is by Sudwork Brewing, which is out of Davis, California. I believe that Sudwork is the brewery where all the students in the brewing program from University of California, Davis, go to intern when they're getting to the end of their program. They do have a regular brewmaster there but then they have a bunch of the students working. So, very interesting. So this is by Sudwork. It's their Funke Hopfarm, which is a play on funky. It is a dry hopped sour saison. It is a Cessar 6.5% alcohol by volume and it's dry hopped with Nelson Sovin, Citra and Simcoe hops. So sounds good, sour, saison, Citra, Simcoe, Nelson Sovin, sounding good. Oh, I should show you. Look, it's some farming bears. Not like the most exciting label art, but it's label art. Oh, yeah, pouring very orange-ish with a little bit of a head to it. Oh, very, very clear. I would have expected some sediment going on in this, like some decent sediment. But no, I mean, yeah. Wow, it looks like an IPA, basically. Very interesting. Let me smell. Ooh, I get the Citra and the Simcoe and Nelson Sovin got a nice hoppy, citrusy aroma to it. A little bit of a caramel-y aspect as well. Some grapefruit in there. The dry hopping is really coming through in the nose, like crazy. And then it's got that nice sourness. It's got a very tart, like, lemon. Or sometimes when you get like real tart oranges, not a whole lot of bitterness at all. But it does say it's 15 IBUs, so, yeah, low on the bitter. Oh, my gosh, smells really good. It's got a little bit of that saison-y yeast smell as well. It does smell a little bit of a funky aspect to it. Must be some Britannomyces. But really interesting, the play between the citrusy hoppiness and the citrusy sourness. It's very, very interesting. Can't wait to try this. Right before I took a sip there, I got a smell of like a citrus bubblegum type thing. Like a little bit of like a typical bubblegum mixed with a citrus bubblegum. Interesting. So immediately, I get a little bit of the hop right up front, citrusy, a little bit of a caramel-y aspect as well. And then it goes quickly into the sourness, which builds up and then builds back down and then there's a tad bit of bitterness on the end. Nice mouthfeel. Very crisp, very refreshing. Mmm. That's pretty good. The hops, yeah, it's so interesting. The hops versus the tartness in there, it's just, it's an interesting beer. It's going to be a lot of fun to continue sipping. And I feel like I'm about to eat dinner in a little bit. I feel like it'll be great with a dinner. I'm going to have tacos. I think it'll go well with tacos. So let me see if there's any information on this. This is the second batch that they've done of this. It says, it's a unique blend of barrel-aged brew made in locally-sourced petite sarah and granache wine barrels, carefully crafted with a final round of dry hopping to bring out distinct notes of citrus and stone fruit. Enjoy it with good company and savor the fink, Proust. This is nice. This is a fun, interesting, tasty dry hop soursaison. I'm not sure I've ever had a dry hop soursaison before. Had a dry hopped saison, I believe, before and a souraison, not dry hop soursaison. Very cool. Very interesting. Highly recommended if people can get a hold of it. Sudwork brewing. I don't know if the brewmaster did this one or if it was some students, but whoever did it, great job. Anyway, thank you everyone for checking this out. See if you can get some sudwork, because interesting stuff, especially this one. And stick around for the next episode.


All right headed to an appointment With mr. Roman say hello, bro. Hey there. We are we're here in Springfield you you set up this appoints a local agent you set up appointment Calling some some of our leads yesterday. Yes, so that's for this morning. Yeah, nice. Okay, so it was a call night last night Roman's important for this morning. We're headed there. Stay with us. It's a final expense lead. Yes, it's appointment How long have you been with Secure life direct three days.  You're making money pretty quick then right? Yes. You've already made a couple sales. Yeah, I have that's crazy That's unlike that's that's pretty rare and we're about to hopefully make another one.  We'll be there in about probably three or four minutes And we'll keep you posted. We're gonna run a quick appointment 10 o'clock a.m. Central tender time I'm gonna let you know how it goes. Stay tuned Alright, we're just now leaving the appointment. What do you think, bro? Yeah, it was good man. It was uh We got We sold the gentleman have $42 a month policy and he had 5,000 of coverage We were able to hook him up with 42 bucks for 8329 dollars of face amount. I did three options 45 42 and 39 Same same price More coverage. I Think it was 50 cents cheaper. Yeah, I think you're right. It went It went super good. It's a good meaning. Okay as a new agent you've been you've been in the business Literally, this was a live kind of a live diary about going to an appointment spending time in an appointment We went through we went through the warm-up. We went through the presentation book Finding we went through Presenting the benefits showing three options everything I preach like there was it was it literally identical to what I showed in our training Yes, it was we did a bootcamp for a bunch of new agents. Yes, it was identical, right? What was and then we went through the three options? We end up taking a guy to the convenience store right down the street two blocks away. So it's cool as a new agent what was something that you learned Or are you kind of kind of a takeaway something you can take away from that meeting? Definitely build rapport. Yeah And honestly If we were not gonna get it that was gonna be one thing that held us back because he was kind of hard to warm up Yeah, for a while. Yes, he was But yeah, that's a big takeaway the relationship. I preach it to you guys all the time the relationship is huge Dude, I have what's funny is I haven't ran an appointment. I was just telling Roman. I haven't ran an appointment since probably April of 2017 yeah, it's been almost two years. Did I seem rusty? No We can still got it. Yeah, all right That's just from I think it's from all the videos and all the trainings all the live shows I want to do this real quick though because I want to give you guys a little little inside scoop of actually hey Heading to an appointment running it And then even got a picture of the house as we were leaving. Yeah, I was getting the car And then a video with a new agent can we get a lot of new agents that watch our content watch our channel? They're always curious about running appointments are always curious about hey How do you do this or how do you do that or how does it go? What was something that you noticed like one takeaway that you noticed that? Maybe I did a little differently that you hadn't seen or something unique or like a takeaway from seeing different people run appointments Well, one thing from just being in sales. I saw you did definitely as you went to the benefits and asked him What was most important to him? Cool and he really claimed to the Local yeah, yeah, I was I was shocked a lot of people would normally pick price lock or hole I'll tell you guys this price lock or whole life or something like that this guy picked Local help. Yeah, which was kind of cool the fifth benefit I even threw in a sixth benefit because he was big on immediate payout, you know So that's actually a benefit you guys could use more Any takeaways anything you want like new agent to new agent? Maybe maybe there's a new agent in the other side of the country watching this they're struggling What's some tips that you can give them because you've made three sales in your first like three days? Yeah So you notice that the phone yes, even though most people are scared of it They don't use it is still a big piece because we don't see people you don't make any money That's true. Cool. So pick up the phone get in front of people run the 1510 5 you'll have success Romans Success we talked you through on the way to an appointment. It's what time is it? It's 10 57. So we're there about an hour Not too bad and went through it normally it's a little longer But the guy didn't talk a lot, but hey made a sale for it for it was small Yeah, it was smaller than we normally do it was a total of like 492 almost 500 of AP so smaller than we'll normally do but in this case There was really no other option for another type of sale. So, right? Yeah, it's all right. Thanks for watching Just a just just a local sale that wanted you to be a part of appreciate you guys


Thank you for the introduction. My name is Justin Mayer. I'm from Santa Monica, California. And I work on a server security monitoring tool called monitorial.com. In my limited spare time, I am the primary maintainer of a static site generator called Pelican. And I've had the honor of presenting talks here in Italy at PyCon Italia, at PyCon Japan, and various other Python conferences. This is my very first EuroPython. So I'm super, super excited to be here. And I'm excited to talk to you today about multi-factor authentication. I have found myself over the last couple of years on an unexpected journey and that has now become a personal mission to reduce the frequency and severity of data breaches caused by security vulnerabilities. And my goal is that by the end of this talk that you will have the information that you need to understand what are the problems that we have with our current authentication methods, what are the various ways that that can be improved via multi-factor authentication and the various types, and some specific projects that you can use to implement some of those solutions. But more than anything else, I want you to walk away feeling inspired, feeling inspired and really motivated to do something about this, to improve authentication security in any of the systems that you work on, any of the sites or applications that you use on a daily basis, and any of the sites and applications that your friends and family use on a daily basis. So let's begin by talking a little bit about the problem. There are an increasing number of breaches that are occurring and the severity of those breaches are becoming more severe. To mention an example that's a little close to me, Anthem is a private health insurance company that's my health insurance company where I come from. We don't have universal health care like some of you and I'm very, very jealous of that. But in any case, this private health insurance company was breached, they announced this breach in February of 2015. The average time to detect an attack is about six months. So that's six months that someone had access to my information and then could use that information to do other things, potentially get access to some of my other accounts. Obviously that's just an average, could be much longer. So what kind of information is at risk? What kind of information was potentially stolen or actually was stolen? So there's what we call personally identifiable information and that can involve birth dates, social security numbers, street addresses, email addresses, employment information, income data. There's a lot of information that's very sensitive. Anthem, this company claims that no medical data was stolen but I don't know that anyone actually believes that. There were 80 million people affected in this one breach. And when I thought about this, I realized it's not just my data. This is the data that affects my friends. My mother, she's 75 years old, she has some memory issues now and this is her information that's also been stolen. And I decided at this point that this was now personal to me because you can mess with me but you cannot mess with my family. So I decided this was something I was determined to do something about this. And this is just one attack. Last year in 2016, there were one billion records that were stolen worldwide. So it's a very significant problem.  It's called Have I Been Owned, Pwned? I don't even know how you pronounce that. .com and you can find out whether or not you've had information of yours, either a username or an email address that has appeared in some dump of stolen information. And the answer to the question of has your information been stolen and is it in one of these public available things? The answer is most likely. When I checked, there was not one but like seven different dumps or breaches. If everything from Dropbox to Adobe to LinkedIn to Tumblr. So the problem with these breaches is that there are costs. When you have a system compromise, you have the potential loss of system availability. If your system goes down, this can mean lost customers, angry customers. Data can be stolen as we've covered. You can also lose data if someone accesses your system and just wipes your entire database. And maybe you have backups but for some reason they didn't work properly. That can be a very significant impact in terms of a financial loss. In 2019, it's estimated, in case you don't feel like counting the zeros, that two trillion euro will be lost as a result of these kinds of attacks. Two years later in 2021, that number is expected to triple to six trillion euro. So why? Why does this seem to be happening with increasing frequency and increasing severity? Passwords are not the only reasons that breaches occur but I'm going to make the argument that they are not helping. The thing with passwords is they are ubiquitous. We use them everywhere. It seems to be the de facto standard authentication method that we use. Unfortunately, passwords are terrible and so we use them everywhere and at the same time they are awful and I'm going to make the case as to why that is. So why are they terrible? Usually authentication methods are evaluated using two important criteria, security and usability. Traditionally, this is involved some degree of trade-off so that improving one sacrifices the other. Hopefully someday we'll be able to fix that a bit but at the moment and in the past it has been a zero-sum game. So this is, if you have, I'm going to make the case that passwords have bad security and bad usability so it's like the worst of both worlds and when you consider this as our global standard for authentication, it's kind of amazing to think about that we've chosen this thing that has bad security and bad usability. Let's start by looking at the security side of it. The reason for the poor security of passwords, there are many but one of the most important reasons is that people choose really bad passwords, really bad passwords. You've probably seen something like this before. You maybe even have dealt with friends or family members that couldn't get into their account and when you finally got out from them what their password was, you were just dumbfounded and couldn't believe that it could be something so insecure, the most common password, one, two, three, four, five, six, this accounts for 17%, that's nearly one-fifth of all accounts, of all passwords used by human beings that are protected by this password. So why is this bad? Well it's bad for a few reasons. One, it is trivial to brute force. Any machine, your phone could brute force. A one, two, three, four, five, six password. But why would you even bother brute forcing any of these when they're so easy to guess and you can just look them up in a password list? Another issue is unprotected passwords. Even if you've chosen a secure one, people will write them on paper, have it taped to their desk, they'll send them to a friend to share an account via email or via text message. I've seen people send their passwords to themselves via email so that when they're on vacation they can use their phone to get into the site. So this happens very frequently. People will reuse passwords. Instead of using a different password for all the different things they do, they'll reuse one. So if it's compromised in one place, the attacker can use that to compromise your other accounts. And this is a really severe aspect, particularly when combined with a weak password. Another issue is phishing. If you're not familiar with what phishing is, it's one of authentication's hardest problems today. An attacker can create a form that looks like the site you're used to logging into. You can put in the logo, choose the fonts correctly, it can look exactly like Amazon or eBay or PayPal or whatever it is that you are logging into. And when you put your information in there, they just steal it and gain access to your account. This problem is only getting worse. Eric Lawrence wrote a really interesting article regarding browsers and sort of what proportion of the browser can be trusted. And he referred to it as the line of death where you have everything below this line is untrusted. But everything above that line is browser Chrome and cannot be manipulated by the site operator or whoever it is who's trying to fish your details. Unfortunately, as browsers are changing, they're modifying the way the browser Chrome appears and changing the things that theoretically can be modified. So now we're going from the line of death to zones of death. So the less and less of what we're looking at at a browser can be trusted. And it's getting even worse now with HTML5's full screen API because now you can manipulate everything on the screen. We've gone from zones of death to a wall of death. Literally nothing at this point can actually be trusted. It's just death all the way down. So we've established that, in my opinion, password security is terrible. What about usability? If you choose a very secure password, usability suffers because you're probably never going to remember it. And if you choose a memorable password, chances are it won't be very secure. So regardless as to whether you have a secure password or not, people will forget them and they forget them constantly. And as a result, we have poor security, poor usability, worst of both worlds. So why is this? Part of it is that authentication is hard. And if we had a better solution to replace passwords, theoretically we should have replaced passwords a long, long time ago. But what if inertia also plays a role?  We've adapted that concept for computers and we're so used to them that we don't really think of too many other ways. It's just kind of become how we handle things. So as a result, instead of replacing passwords, what we've tried to do is fix the problem. And so I'll talk a little bit about the mitigations and the ways we've tried to fix it and how they sometimes don't work. So password managers.  I feel like everyone in this room is probably aware. They address some of the security problems with passwords and perhaps a lot of them. But the usability of password managers kills adoption. I feel like many of us use a password manager. We probably feel comfortable with them. But the usability of having to remember a single secure password, type in it every time just to get into something, copy and paste a password. Even if there's browser integration, people don't understand how to use the browser integration. The usability really hurts the adoption of password managers. I've set up password managers for friends and family. I've come back months later. They've never used it. So limiting failed login attempts. Sometimes, you know, like five attempts, you can, if you fail five times, you get locked out. Seems like a good idea, except when you realize that now you can lock other people out by just trying bad passwords and then now you've locked them out, they need to go through some process to get back in. Becomes a denial of service vector. This is a bad idea and basically no one does it anymore but every once in a while you see it. Changing your password often. This advice you do hear every once in a while, even in 2017, which is kind of amazing, this is bad advice. You know, it sort of follows the principle of unforeseen consequences. People then reuse the same password everywhere because then once they change it, they tend to change it, you know, across the board so that they can remember the single insecure password they're using across all of their things. Security questions. Again, probably seemed like a good idea when someone came up with it but they are terrible because they're built in passwords most of the time. Mother's maiden name. Your first pet.  These are built in passwords that you can't revoke if those are the only options you're given as security questions. Obviously you can just put in gibberish, that's what I do and just put in random stuff in there but that's not what most normal people do. So as a few weeks ago, security questions got even more terrible because some password reset processes, instead of sending a link via email, they all ask you for your security questions. And so a clever attacker, a clever attacker and you really do have to admire the sinister deviousness of the person who came up with the password reset man in the middle attack is they create a registration form for something that you want. Like let's say you're trying to download a book that you don't wanna pay for and you go to some site so you can download it and they'll ask you to register. So you put in your email address, they'll ask you for security questions. They will then simultaneously take this information and pipe it into other common sites in hopes of getting access to your accounts. Again, very clever, but also very bad for anyone who uses passwords. So the industry has rallied behind this idea that because of all these problems that we have to somehow encourage users to come up with stronger passwords. And this solves one of the problems with passwords, but it doesn't even solve that problem very well because the complexity rules and strength meters, people just don't understand them, they find them confusing. And as a result, they complain. I have friends that estimate that at their large organization that over 50% of all of their support requests relate to passwords in some way or another. That's a huge percentage of support requests having to deal with this one broken authentication method. And my own experience bears that information out. The other thing is users will leave. At some point, they just get frustrated. They'll look at these rules and the strength meter and they'll just leave. And one of the reasons is that it's user hostile. You have often complexity requirements that seem totally arbitrary to inexperienced users. And oftentimes, even to experienced, technically inclined folks, these are really arbitrary rules. It drives me insane when I see someone tell me that a 10 character password that where they require mixed uppercase, lowercase, a number and a symbol, that that's okay, that that meets their requirements. But my 35 character password with whatever characters I want to put in it is rejected. One of those is a lot more secure than the other and I think you probably know which one. Users find these strength meters really confusing. They will settle for anything just to make it turn green. And so we eventually get these medium strength passwords instead of actually really good secure passwords.  And most importantly, because of password resets that go to email, your system can only ever be as secure as the security of the email account that the password reset link goes to. And of course that account is protected by the user's password, which as we've established, generally not very good. So it's kind of terrible all the way down. So thankfully, there are some new approaches. Many people have tried to replace the password and nearly all of them have failed. I'm gonna talk about some that I think are promising. So some of the alternatives are gaining traction. One of them is email. When we created Monitorial, we decided to use email as the sole authentication method. We collectively, none of us liked passwords.  And so we decided that we were going to not have them at all. Users never have to choose a password, they never have to enter one. And the way that registration works is the same as the way log in works.  When you come back to log in some other time, same process, tap, link arrives, tap logged in. You can decide, as I'll talk about, whether you want to leave that session open, just like any authentication method, you get to decide how long you want that to be left open. The links time out. So a login link, when it arrives, it's not good forever. I think ours is 15 minutes, maybe 20 minutes, but you wouldn't wanna leave a login link lying around for days or weeks or months. Email-based authentication can be used either as a single factor or in a two-factor context. We've always used it as the primary and sole single factor. In fact, it's really the only authentication method, and in my opinion, it provides decent security and usability as a single factor. I've already mentioned that username and passwords, I don't think meet that goal. And so some of the other authentication methods, as we'll see, are really only useful in a multi-factor context. So whether used as either single, sole factor, or second factor, you get good security and good usability with email-based authentication. So even without adding multi-factor authentication, email-based authentication is already an improvement over the usual username and password combination. The adoption of email-based authentication is growing, but really, really slowly. Aside from Monitorial, I think Medium, Twitter's site publishing tool, is probably the only one off the top of my head that I can mention that uses this. And I'll talk about some of the downsides. I don't know if that's why there's slow adoption or not. One is, in theory, mail delivery. So you need to be sure that these login links arrive via email and that they're not somehow routed in spam. We've never had this problem. Our login links arrive because we take very good care to set the right SPF and DKIM and all these different records. So we haven't had a problem with that, but it's at least, in theory, an issue. People are accustomed to passwords, as we've talked about. I think inertia plays a big role. And this is weird and they don't get it and they don't understand it and they just don't like it because it's different. Some experienced users don't, in theory, I've never actually heard this, but I could imagine that some experienced users might not like the latency because you tap the link, you have to wait for the email arrive. It's usually really fast when I do it. But if someone's used to hitting a shortcut key and having their browser integration, autofill, their username and password, it's mostly instantaneous and this delay of however many seconds, 20 seconds, 30 seconds, or maybe it's just switching to the email client. Maybe someone doesn't like that. Like I said, I've never heard that, but maybe. And the main problem that also affects username and passwords because of password resets is the account can only be as secure as the email account. So that part is shared with username and passwords. When most people think about two-factor authentication, they think about getting a code via a text message. Sometimes you can opt to have that arrive via a phone call. This is a very common method. Unfortunately, it's not a good method. SMS messages are often displayed on lock screens. This is a small concern, but it's at least a concern. If it's lying in a crowded place and it appears on your screen, someone else could see it. A much more severe problem is that this authentication method is tied to your phone number, which you get from your phone company, which means this method is not in your control. And attackers will use social engineering to call phone companies to have your accounts reset via email. If they've got access to your email, well, now they've bypassed the second factor altogether. They'll also use social engineering, in some cases, to have a new SIM card mailed. They'll say, oh, I lost my SIM card. No problem, we'll send you a new one. Well, now you have access to everything. Phone calls, SMS. But it even gets worse because earlier, a few months ago, it became more widely known that there's a flaw in signaling system number seven, or SS7, which is a signaling language that over 800 telecommunications companies use to interoperate. And this scales much better than social engineering.  You can do this in a more automated fashion. You can hit many more accounts and steal a lot more money. So this type of authentication, in my mind, in many others' minds, is deprecated. It's just a bad idea, and if someone asks for your phone number in order to set up multi-factor authentication, you already know something is wrong. So TOTP, or time-based one-time passwords, I will just refer to this as one-time passwords, or OTP from now on, just to save myself one syllable. This is based on Internet Engineering Task Force RFC, and it combines a shared secret key with a current timestamp and uses a cryptographic hash function to generate a one-time password. This is often rotated over a certain time period. Sometimes it's 60 seconds, usually it's 30 seconds. It usually also comes with a static token fallback. So if you don't have your phone, if you lose your phone and you really need to get access immediately, you can use these static tokens that are sort of one-time. You use it once and then you can't use it again to regain access to your account. This is really starting to gain momentum. And so we've seen folks, GitHub, Linode, Google, Microsoft, Amazon, Dropbox, WordPress, Facebook, Rackspace, goes on and on. So a lot of people are starting to use this, in part because everyone has a smartphone. And it does provide good security. The way that this works on a phone is you'll use something like Google Authenticator or Authy. I use a password manager called OnePassword and their iPhone app version of the password manager has support and actually their Mac version, probably their other, all their desktop versions also have support for one-time passwords. For folks that are more of the Linux free software crowd, KeyPass XC just released version 2.2 containing support for one-time passwords, which is exciting. So in terms of how it's used, this is an example of how it's done with GitHub. You sign in with your username and password and as a second step, you are prompted to put in this six-digit number in order to complete the authentication and to proceed. I think with GitHub, I don't recall what their timeout is. It feels persistent. I feel like I never am prompted to do it again unless I'm using a new device. But maybe it's just really long and I don't remember. Linode is another example and they offer a trusted agent setting that's explicit where you can check the box or not check the box. Maybe you're using a public computer and you don't want any persistence. You don't want to trust this particular browser instance. Their default is 30 days. So good security, there are some problems with it. So it is subject and vulnerable to phishing and man-in-the-middle attacks. Just like someone who creates a form to try to capture your username and password, they can do the same thing to capture your one-time password. Obviously, they need to be quick about it because the code's only used for a certain period of time. But in today's day and age, it's not too hard to automate and in theory, this could be used to get access just like if you didn't have one-time passwords. The usability is also a big problem with one-time passwords. It's just too complicated for most people. Scanning QR codes and then pulling out your phone and then looking up the entry and then finding the code and then copying the code and then pasting the code, if people aren't gonna use password managers, they're probably not gonna use this. Hardware keys. So there are various different kinds, some of which support one-time passwords as well. I'm not gonna cover most of those, including the one-time passwords because in theory, it's subject to the same phishing attack as a software-based one-time passwords. So instead, I'm gonna focus on universal second factor or U2F. U2F is a USB-based, very tiny, portable device. It is very hard for someone to get at the data that's contained within. It is supported by GitHub, Google, Dropbox, and a few others. It's slowly getting steam, much more slowly than one-time passwords, but it seems to be catching on a little bit. The way it works is there's a challenge response authentication flow. It's based on public key cryptography. And the U2F device generates a new key pair and key handle for each registration, for each of the different sites or applications that you're using. And these application-specific keys prevent tracking the user across different user accounts. So there's also a privacy benefit as well. This provides really good security. It is virtually impervious to phishing and man-in-the-middle attacks. The cryptographic handshake happens automatically behind the scenes without having to copy and paste anything. So there's a really nice usability component to it as well. And Google did a study over two years across 50,000 employees. And they concluded that this worked really well for them, that it was better than any of the other available options and they use it as far as I know across their company. So good security, good usability. It's a win-win. There are some downsides. And one of the biggest today is browser support. Only 27% of the current global population uses a browser that supports U2F. And all of that is essentially Google Chrome because there's only two browsers, Chrome and Opera, that support U2F. And like I said, 27%, it's all basically Chrome. There is a Firefox add-on. It is barely maintained. When I tested it, it wouldn't work with registering a U2F key, but if I used Chrome to register it and then tried to log in via the Firefox extension, then it would work. So that's not a viable solution. There's a, for those that use macOS, which is right about now. And as far as I know, they are not much further. So I'm hoping that by the end of the year, we'll see it. And what about Microsoft? Microsoft browser support is listed as not currently planned. So to the extent that Microsoft's browser share doesn't continue to decline into nothing, this could severely hamper adoption. There are, so what I've established is that U2F works well in a controlled environment. Of course it works well for Google. They dictate policy for employees, computers, browsers, applications, everything they do. But how well does it work outside of a controlled environment? How many people today are gonna go out and buy this little thing that costs anywhere from 10 to 15 euro and works with one browser, and it only works with one or two of the dozens or hundreds of sites that they log into every day? It just doesn't seem like a winning proposition right now today. Lots of people have smartphones. Almost no one has a U2F key. And so you can see why there's so much more support for one-time passwords than U2F keys. Some of the other issues are that desktop machines aren't really set up for this arrangement. I have an iMac on my desk, and the USB ports on an iMac are on the back. So part of the way that U2F keys work is there needs to be a minimum user input. You have to put your finger on the device. Not long, you don't even have to push a physical button. You just tap it like that. Well, if it's on the back, I can't even see it. So I'm lucky. I had a USB extension cord lying around, and I strung it in between my very weird keyboard, and so I can hit it fairly easily. How many other people have that extension cord lying around? What about mobile devices? It doesn't work on a phone to have, where am I gonna put this USB device? What if you're traveling and you've forgotten the U2F key? It's not good as a single factor, and obviously, the reason why it's not good as a single factor is someone could just walk by while you're in the bathroom, take your key, walk off. Well, now they have access to your stuff, but that's the only factor. So the physical nature of hardware keys are both a strength and a weakness. That said, for people who are in controlled environments or for people who have the knowledge and the motivation, U2F keys have the potential to provide really strong security and really great usability. I'm just gonna touch on biometric authentication briefly, really good usability, right? Put your thumb print, look at a camera to get iris or face recognition, great usability, terrible security, and the reason why the security's bad is that it's non-revocable. You cannot revoke your fingerprints, you cannot issue new ones, you cannot revoke your face. Yeah. Yes, yes, and you know, it's even worse when you use it as a single factor. You know, it's like, I have an iPhone, it's used as a single factor. If I put my thumb print on it, I get access to the phone. Yes, they periodically require me to enter my password, but just generally speaking, this is not something we should be emulating. All of these different things can be used in conjunction with like a trusted agent capability where you grant some trust to the browser instance or application for a certain period of time. So, but these different things are meant to be combined, not used independently, and that's why we have the term multi-factor authentication. I prefer that over two-factor, just because if someday I decide that this thing is super important to me and I want not only email-based authentication, but I want a hardware key and one-time passwords. I might want that someday, so I'm gonna go with multi-factor authentication. So there's no magic combination. We are still experimenting and trying to figure out what works best. So far, I'm leaning towards a recipe that begins with email-based authentication by default and only that. Again, because it provides better security by itself as a single factor than usernames and passwords. And then optionally, not mandatory, but optionally allowing the user to add universal second factor keys or one-time passwords as a second factor. I might consider adding the ability for someone to switch to username and passwords if they really were like, I don't like this method. I wanna, I choose strong passwords and I manage them well, might consider it, but if I were to do that, I would only do it if they also enabled multi-factor authentication that have to use it in conjunction with either U2F or one-time passwords. So why now? Why should we be having this conversation? Why should we be considering doing something about this now? The cost of not taking action, as I've made clear, is only getting more severe. The technologies are getting more mature and they're starting to be vetted by large companies and used in mass. So these things are starting to become more stable and trustable. Many organizations, however, still lag behind. I was, again, this is personal to me, so I started looking at my own banks. And I was, as you can imagine, not pleased with the results. Some of them offered a whole list of like five different multi-factor authentication methods. All of them were terrible. It was, you know, face recognition was one, some one-time password that was proprietary and not based on the RFC. I couldn't use my built-in app. There was all kinds of problems. One of them actually supported U2F and then required a SMS fallback, rendering the U2F support completely useless. So this situation, when I look at my own banks, it starts to get me aggravated and makes me want to do something about it. So what can we do? The first thing to do is to apply pressure to both sides, the sites you use every day, and the browser vendors. An example is domain name registrars. I use Namecheap. And so I have a lot of domains and those domains have value to me. And if someone were to gain access to those, that could cause very significant problems for me, for, you know, for my income, for a lot of things. So these are high-value targets and yet most have really terrible security. You know, Namecheap added SMS-based second factor authentication four years ago. People have been clamoring for them to add something stronger and more reliable. And for years, there's been nothing. But someone complained really loudly and very publicly a few months ago, two months ago exactly, and the CEO responded and said very publicly that he was committed to a proper one-time password-based authentication scheme in exactly two months. And that two months is today, in July 10th. So I'm very excited to, by the end of the day, to see that they will probably not have actually implemented it. On the other side of the equation, call out Mozilla, Apple, Microsoft, as the laggards that they currently are. They are lagging behind and they need to be told that. Be vocal, be insistent, and demand that they add support for U2F to their browsers. That's something that we can actually get them to do. This type of pressure does work. But it will take time. And it's not in our control, ultimately. We can be insistent, but they have to actually do something. But there is something that you can control and that's the things that you build, the things that you work on. A good first step to that is requiring multi-factor authentication for any administrative console access. So whether it's Django or whatever is here you're using to do administrative level access, require multi-factor authentication for all of those things. I understand that you can't always insist that all of your users use it. But you can usually, without too much fallout, insist that your administrators use it. And then offer that same strong multi-factor authentication to your users as an option so that if they are aware of it, if they're something that they want to improve, they can. And choose good ones. Some combination of maybe email-based authentication, U2F, or one-time passwords. So I want to talk a little bit about specific implementations. I'm gonna focus on web applications and specifically on Django. I hope that there are similar situations, I'm sorry, similar solutions available for Pyramid, Flask, Twisted, and other frameworks. But Django is the one I'm familiar with. When we built Monitorio, we used Django NoPassword. And this is a very good project. They have good docs, fairly simple to implement for new projects. Obviously a little more challenging if you're trying to retrofit it onto an existing project, but still doable, I would think. All of the different multi-factor solutions that we will talk about, by the way, will assume username and password authentication as the first factor. And so that's relevant to this discussion because when you're using email-based authentication, you're already deviating from what the other packages that offer one-time passwords or U2F multi-factor authentication, you're deviating from what they expect, and so you have to do a little bit more work. You can't use some of the built-in forms. There's another project called Django Rest Framework, passwordless, kind of long. This is a newer project in the last few months. I don't have any direct experience with it. It is designed for API authentication. So if you're more concerned with authenticating an API and you use Django Rest Framework, then this is a good project for you. I'm gonna mention Portier briefly. It's a project by Dan Callahan of Mozilla, and it's a spiritual successor to Mozilla Persona, if you remember that. It's an email-based passwordless authentication service that you can host yourself. If none of the other solutions seem like a good fit for your organization, maybe you should check this out. When I was really looking and starting to really dig into the multi-factor authentication options at the implementation level, I first started with Django OTP, and it has good documentation. It's updated regularly, and one of the issues I ran into interestingly enough is that every site I've gone to that has OTP support assumes that you will only use a single device. And this project has a little bit more foresight and assumes that you might have users who want to have multiple devices. You might have a UB key with OTP support, you might have an OTP app on your phone. This is good and bad. If you decide for whatever reason that you want to do what GitHub and Linode and others are doing and just offer one, like we just assume you're only using one, then you're gonna have to do more work because the forms they provide assume that you're gonna present them with multiple OTP devices. This project has a plugin for UB key hardware OTP support, so that's nice if that's what you're into, and it includes built-in forms for both the Django admin and for non-admin views. Again, as I mentioned before, these forms, unfortunately, they assume username and password. So if that's what you want to use as your first factor, then fine, if you want to use email-based authentication or something else, you're gonna have to do some more work. More significantly, these forms assume that multi-factor authentication is required, that you are mandating it for all of your users. And if you can do that, great. If you can do that without people complaining, fantastic. But if you want it to be an optional opt-in feature for users, you're gonna have to delve down into some lower-level APIs. Thankfully, in my experience, because, again, I didn't have access to those forms because I'm trying to apply this to email-based authentication, the low-level APIs are well-documented. I didn't have really any trouble implementing it as optional multi-factor authentication with email-based authentication. So after I experimented with one-time passwords, I really wanted to look at U2F. And because of the limited browser support and some of the other shortcomings, I was skeptical. But the code repository includes a demo project. I was really excited by that. You almost never see that. And I got really excited and like, oh, this could be up and running pretty soon. So I tried the demo project, worked really well. I thought, okay, now I'm gonna set that aside. I'm gonna use the Django admin start project command to generate a completely fresh skeleton project. And I'm gonna see what do I need to do to turn that into something where I can use multi-factor authentication and see how easy that is. So I'm gonna show you. Not as a live demo. No, we don't do live demos. So first step is to install Django U2F and its dependencies. Easy enough. U2F requires secure HTTPS connections, even for local hosts. So one of the steps to getting up and running is by generating a self-signed certificate. And that's kind of part of the process. They provide a script that you run. It kind of does that work for you, which is really nice. So I'm gonna kind of go through the different changes that I made, just so you can see how little work I did. And so everything that, all the other screenshots, you'll see after this about like the actual usage. I literally did nothing else other than these diffs that you're about to see. So added a few things to install apps. Added a couple of settings at the bottom of the settings file in URLs.py. Made a couple of changes to import the Django U2F URLs into their own namespace. Created, this is really a copy paste from what the project provided, but copy pasted a base.html template in the root templates, base.html. And really the only purpose here is to display messages if there's an error so you can actually see them. And at that point, you run Run Server Plus. I've never used Run Server Plus, presumably this is needed for the certificate support. But you run this command and we're off to the races. So again, this assumes that the standard username plus password combination is the first factor, that's why we see username and password field. Unlike Django OTP, here, multi-factor authentication is optional by default, is not mandatory. So you can tap manage U2F keys and we haven't added any keys so no keys are listed. So we tap on the add another key link. At that point, we follow the prompts and we take the key, our little physical key and we stick it into the USB slot. And at that point, there's a little indicator on the key. It actually starts illuminating and flashing. This is your signal to tap the side or top of the key. You just make contact with your skin and then immediately we see key added shown in the browser. So from the main menu, let's choose the manage backup codes option. Backup codes, as I mentioned before, are emergency codes, you use them once if you lose your device and you need to get access. So you tap the create some backup codes, it generates a list of backup codes, you copy them, paste them into your password manager or other secure vault and you have that should you ever need them. Now let's set up an OTP device. So as before, we haven't set up any OTP devices so none are displayed. If you tap the link to add one, then you see a QR code. As well as a text version of the shared secret key. I think QR codes are silly. I've never seen a good use case but if there is one, it might be this because this makes it a lot easier to get this shared key into your phone. And so the way that looks from an app interface is this is one password. This is what I use for log in. So you create a log in username, password, just like you would for any other account. If you then edit it after you've saved it, there's an option towards the bottom that says add new one-time password.  As you can see here, I pointed at the screen. The recognition happens really fast and believe it or not, somehow I managed to actually get a screenshot on the first try, I don't know how, but I did, so here it is. You'll see a code scan thing on the top once it's recognized. And so now when you look at the login entry, you'll see this countdown that goes down every 30 seconds. So now that we have an OTP token, let's switch back to our web application. So we have a token, we put it in the form, we submit it, it says device added. If we tap on manage the OTP device link, we'll see that we have the device added and you can remove it, revoke it, if for somehow it gets compromised. So logging out, we see that what the log in process now looks like, it's different than before. You're still putting your username and password, but now when you get here, you can use your U2F key, you can use a one-time password, you can use your static codes, you have now three options. And I love having all these options. It reduces this lockout anxiety that someone might feel. So I'm really impressed with this project's simplicity and the first run experience. If you're creating a new Django project, consider using this to add multi-factor authentication because you get so many things kind of built in. Or try Django one-time password if you're not interested in U2F keys.  Demand that your sites and your browsers support multi-factor authentication. We can do better, but only if each of us individually take some action and do what we can to improve the security of our authentication, not just for ourselves, but for the people that we care about. I'm working on a more detailed guide for implementing second-factor authentication. So reach out via any of the above methods and I'll notify you once that guide is available. And with that, we don't have any time for Q&A, but I would love to meet you. I would love to talk to you. So please come up afterward and say hello. Thank you very much for coming today.


This paper proposes a new method for manufacturing natural fibre reinforcements using short-flax fibres and unidirectional flax yarns, inspired by papermaking process. The study shows that the addition of short fibres decreases longitudinal tensile modulus and strength by about 10%, but increases transverse tensile properties by almost double. In compression loading, the compressive modulus and strength are reduced by 30% in yarn direction, while transverse modulus is slightly increased. The presence of short fibres also improves fracture behaviour in tensile loading by making the fractured surface more uniform and reducing splitting and crack formation along unidirectional yarn direction. This article was authored by Mohamed Habibi, Luc Leperrier and Hogyat Mahi Hassan Abadi.


Delivering books to and from the Mattis Library. Did you know you can have books from the Mattis Library of the Health Sciences Center Howard Tilton Memorial Library and vice versa? It's easy. Do you research for the book or journal you need? You will notice that this book's location is listed as available at the Mattis Library. Let's click on the location. The next thing we'll want to do is sign into our library account. This uses the same email and password as your other Tulane accounts. Once signed in under request, you'll see an option for request delivery. Let's click on that. Choose your new pickup location. In this case, the Howard Tilton Memorial Library. And click on send request. You will then be notified via email when the book is available to pick up at the Howard Tilton Memorial Library checkout counter. You can also use this request button to have books and journals located at the Howard Tilton Memorial Library sent to the Mattis Library. Good luck with your research. For more information, contact us at libraryatchulane.edu or visit our library's website at library.chulane.edu.


Good day, fellow investors. Welcome to the stock market news with a long-term fundamental twist. And over the last few months, there has been a lot of commotion about gold, as it went from 1100-1200 to 1500. And there is a lot of gold, let's say, cheering in on YouTube. I want to give you really a fundamental risk-reward perspective. Nobody can predict gold prices over the next three, six months longer term. But what you have to understand is the risk and reward of what might happen and how to apply that to your portfolio in order to make money on it. We're going to discuss the gold bull thesis. As mentioned, the risk and reward, the historical price of gold, the cost curve. So what are the miners' costs to produce that gold? Compare it to the price. And then discuss gold miners, how I approach them, how you can invest. What's the risk-reward? Ray Dalio's approach to investing in gold. What does he mean when he says how to invest in gold? I'm going to finish with the way I'm exposed to precious metals by declaring my silver investment that I am already long for a while. And that should give you a good perspective on how to invest in gold in 2019. Let's start. When it comes to YouTube, you must be really careful about fear. Fear is easy to sell. If I make a video, stock market crash, economic collapse, views shoot up. Because people are triggered by fear, they are afraid to lose what they have, and therefore they watch it. And it's easy to sell. So if you make people scared about recessions, about inflation, about losing their job, etc., you can sell them easily on, let's say, an investment, a hedge like gold. And on YouTube, there are many, many investors like that. YouTube channels that are like a broken clock, they keep telling people gold, gold, gold, buy gold. It's the best investment out there. There are only positive things on their websites. But you have to understand their business is commission on buying, trading and selling gold. So they have products that sell, make money on whatever happens with the gold price. They just need people to buy gold. If you look, how does a broken clock work? Just Google, for example, Peter Schiff 2011. The worst is yet to come for the markets and economy. The markets are up two times since then, probably. Gold price correction 2011. This was written December 2, 2011. What correction? Gold prices will just continue to go up. Unfortunately, those that invested in gold in 2011 are still down from the peaks. And here, that's what I don't like, very good theory with Peter Schiff. I agree with a lot of his points, but he's not, he's only showing the possible reward. He has to show the risk out there. So, and that's what I'll do here. There is the reward. I agree with Peter Schiff. I think gold can go to 5,000, 20,000. Nobody knows, but you have to always put it in a risk reward perspective to see what will happen. Let's check this a little bit. So over the last week, last week, gold prices dropped actually as things cooled down in Hong Kong. Maybe there will be a deal with the trade wars. Brexit will be easier or at least will be with a deal or something like that. So things happened. Stocks went up. Gold went down. And over the long term, still gold is up hugely, but stocks are too up hugely. So on top of it, stocks give you a dividend. So it's not really set that you will make money with gold in place of stocks. But let's look at the historical price. This is the long-term trend. This is since 1971, since the conversion gold dollar was canceled. So since then, dollar was debased and gold prices rose, or better to say the dollar lost its value compared to gold. So gold prices went to 65, from 65 to 685 in the 70s, 81, then there was 20 something years of just going down from 685 to 250, then spiked up to 2011, then down to 2016, I think was the low when it hit 1050. So from 2011 to 2016, five years of very, very negative news. And then since then it spiked again 50% up over the last years. The thing is that nobody knows where gold prices, nobody knows where gold prices will go next over the next five years, neither 10 years. Nobody knows because this is really unpredictable. We don't know how much of things are priced in, how much are not priced in. There are many ups and downs, smaller ups and downs that make you think this is a new trend and then it reverts, etc. Further ETFs, as gold prices go up, people rush into buying golds and then push gold prices even higher. But when gold prices start going down, people rush into selling those gold, they don't want to hold gold in ETFs. And you see how the really key here, the real key here is behavior. How are people going to react towards what's going on in the economy and are they going to seek gold or not? The fact is, can you handle a 30-40% decline in gold prices over the next 12 months? That's a question, not that it's going to happen. Can you handle it? If you can handle it, if you can rebalance like Ray D'Aliu is saying by adding more than, then you are up to investing or speculating with gold. On the other hand, gold doesn't give you dividend, there is no yield, there is a cost of storage and you cannot lend it out to someone, etc. So that's something you have to keep in mind when putting gold into your portfolio. That is the risk-reward perspective. Let's go to the fundamentals. When analyzing any commodity, I always like to look at the cost curve. So this is the cost curve for gold and you can see that the average all-in costs are around 1,080 per gold ounce. There are very low cost producers with 600-800 all-in costs and then the average is around 1,000 and then up to 1,200 and even higher, depending on the mine. But in general, most miners at current gold prices are having very, very, very nice margins. So the question is, how sustainable is this without real inflation, without real inflation in the mining costs? That production will probably go up, there might be oversupply of gold later and that might push gold prices down. So keep this in mind. I always look at the average cost, production cost for every commodity, just on a healthy margin there, that will be the average long-term price of the commodity. Until these mining costs don't change, there actually isn't inflation. So we cannot see long-term gold prices being high. If you go back to the long-term chart of gold prices, look, they have fallen to 1,050, which is the average mining cost. So the spike, the exuberant spike was there for the demand, for the quantity demanded. But then those returned again down, we have again a spike and we'll see how it will evolve. Nobody knows where the price of gold will have, will go. You have to see how to go about investing in it. If you go into gold miners, I made an analysis of many gold miners in October 2018 and then looked at the cost price, their leverage and their exposure to gold. If you want to have exposure to gold miners, if gold prices go up, they should give you much more leverage. If gold prices go down, there is much more downside possible. So for example, all gold miners really spiked up 100, 150 percent over the last few months. Alas, gold was a company that I sold and then it shoot up even more from the 70, 80 percent I made on it. So that's thanks to gold prices. If gold prices revert, this thing might revert to the lows that we have seen just five, six months ago. So be careful about that. So now in my table, I wrote that if gold reaches $2,000, for example, evolution mining should have a price of $6. When I wrote that in October 2018, the price was $2.2. Now gold is just at $1,500 and the stock has really spiked up more than doubled since then. So a lot of future expectations about gold might be already baked into the current higher prices. So my point is that you have to really be careful how to balance this. If we go to Ray Dalio, he says, yes, investing gold have portfolio exposure in gold, but then he's always about balancing risk in a portfolio. The higher gold prices go, the higher is the risk. The lower gold prices go, you have to always be a contrarian. You have to buy when others are selling and sell when others are buying. So those that bought at $1,000, those should now sell at those exuberant investors there are now buying like crazy. As we have seen in ETF, gold prices and demand for gold ounces is going up. And whether gold will spike to $5,000, $10,000, $2,000 depends and you have to keep in mind the timing. 2011, everybody was expecting gold to continue. It didn't for the next five years. It went just down. And that's something you have to be prepared, especially over the long term. So I'm trying to give you the long term perspective here on gold so that you can be ready. If I buy gold now for gold exposure, am I ready to see it down five years from now? Am I ready to trade those 10% changes, 15% changes in gold prices? When it goes up, I sell a little bit. When it goes down, I buy a little more. And then by doing that, you can have a yield on that gold. You can actually lock in a trading yield on the gold. So that's a perspective when some rational investors try to look and have gold portfolio exposure. If you want more ups and downs, then you have miners that gold goes up 20%, 30%. Miners go up 100% as we have seen lately over the last few months. But vice versa is also possible. Now, I have portfolio exposure. I bought two miners last year. I still have, I think, Polius gold. It's a good dividend, low cost miner. Whatever happens, it will be still a good business. So I'm buying businesses. And I made a video about Vedanta. I think it was a month ago. Now, the stock price is even cheaper. So check that video out. It is a commodities miner. So if we have inflation, gold prices will go up. But also other commodities might go up and stay up also the same with gold. So nobody's looking at commodities. Everybody's exuberant about gold. But again, if you want to buy what others are not buying, you might want to look at zinc copper miners. And Vedanta is just one part of my portfolio. So please enjoy the video about Vedanta. If you want to check more about things that I do, more about my research, et cetera, about my book, please check Svenkalin.com. I'm looking forward to comments. I know there will be a lot of angry comments. Yes, gold will spike up. Gold might spike up. Gold might not spike up. Even Peter Schiff was wrong in 2011 to 2015. Now he's doing good. But then he can be all again wrong or right. So be careful about that. It's about predicting the future, predicting the behavior of human central banks, et cetera. We cannot do that. We can look at the fundamentals at the risk reward and then apply to our portfolio. Thank you. Don't forget to subscribe if you like this long-term risk reward approach to investing. And I'll see you in the next video.