Episode 30 of The Security Podcast of Silicon Valley aired on July 3, 2023, with Jon McLachlan hosting. The guest was Dominik Schürmann, co-founder and CEO of heylogin, a password manager with no master password (Podbean). Jon’s introduction started with the job and worked back.
“So Dominik is the founder and CEO of heylogin.”
Jon McLachlan, at 0:14
Dominik’s LinkedIn fills in the dates. He has been CEO and co-founder of heylogin since March 2020. Before that he co-founded COTECH in May 2018 and led it until November 2021, building a Hardware Security SDK, a developer framework for authentication and encryption with security keys and smartcards on Android. From January 2014 to March 2018 he was a research associate at TU Braunschweig’s Institute for Operating Systems and Computer Networks, where he supervised more than 15 theses and published more than 15 papers, and from 2015 to 2018 he analyzed and developed cryptographic protocols as a freelancer for Germany’s Federal Office for Information Security (BSI) and for ENISA, the European Union Agency for Cybersecurity. He was a guest researcher at Aalto University twice, in 2012 and in 2017, the second time on a DAAD scholarship (LinkedIn).
For readers outside Germany, a few of the names on that list. TU Braunschweig was founded in 1745 as the Collegium Carolinum and is a member of TU9 (Wikipedia). Aalto University, in Espoo, Finland, was formed in 2010 from a merger of three universities (Wikipedia). The BSI is the German federal agency for information security, founded in 1991 in Bonn (Wikipedia), and the DAAD, the German Academic Exchange Service, is the joint organization of German universities, founded in 1925 (Wikipedia). heylogin’s about page adds that he holds a PhD in IT security (heylogin).
The tape doesn’t give a recording date. It fits the months before the July 2023 air date: Mozilla had already invested in heylogin, which the company dates to fall 2022 (heylogin).
This page is the rest of it: a section for each part of the conversation with the sources beside it, sixteen figures, nineteen clips from the tape, the full transcript, and five tools: a quiz, a scorecard for whether your security gets adopted, a calculator for the logins that live outside your single sign-on, a timeline from 1975 to 2026, and a to-do list.
A note before the sections. Dominik speaks English as a second language, and a few words on the tape are hard to hear. Where the decodes disagree, the transcript marks its best guess in brackets, and the page doesn’t quote those lines. Numbers he gives from memory, like OpenKeychain’s user count and the 110 SaaS apps, are his account, and the page says so.
We started as COTECH in 2018
Dominik’s first answer was a correction of the timeline. heylogin and COTECH are one company.
“So actually, we started as COTECH in 2018.”
Dominik Schürmann, at 1:13
“And I always say 2018 and 2019 were kind of the years of finding an actual problem that we should solve.”
Dominik Schürmann, at 1:18
Same company, he said, renamed.
The problem they found was password management. COTECH’s product, on Dominik’s LinkedIn, was the Hardware Security SDK for security keys and smartcards on Android, and the heylogin role starts in March 2020, the month he later calls the big pivot (LinkedIn). Jon’s verdict on the pivot was that it was clean.
“So it’s such a good pivot that they look like two distinct companies.”
Jon McLachlan, at 1:40
Visual Basic for Kids
Jon asked what shaped him. Dominik started with a book.
“I started with Visual Basic for Kids. It was a great book.”
Dominik Schürmann, at 2:18
“I think I started at 14 years doing some programming using Visual Basic.”
Dominik Schürmann, at 2:26
“And then I was deep down into modding of a computer game and stuff like that.”
Dominik Schürmann, at 2:32
Visual Basic is Microsoft’s name for a family of programming languages, and the original version was supported from 1991 to 2008 (Wikipedia). Modding is the alteration of a video game by its players or fans (Wikipedia).
Political involvement sometimes leads to cryptography
Cryptography came later, at university, and by a route he named on the tape.
“But when I really got started with cryptography, it was during my university time.”
Dominik Schürmann, at 2:38
“And political involvement sometimes leads to cryptography, I would say.”
Dominik Schürmann, at 2:53
The movement he named was the Pirate Party, a German party founded in September 2006 as part of the international movement of pirate parties, which calls itself a party of the information society (Wikipedia).
“So that got me involved into cryptography.”
Dominik Schürmann, at 3:04
From there it was cryptography through his bachelor’s and master’s, a PhD, and his work as scientific staff.
Trade-offs between usability and security
His research had one theme, and it runs through the whole episode.
“My research was always like finding trade-offs between usability and security.”
Dominik Schürmann, at 3:21
“So it’s not that easy, but it’s an interesting way to think about.”
Dominik Schürmann, at 3:28
The field has a name. Usable security is the part of computer science, human-computer interaction and cybersecurity concerned with the user interface of security systems, and it emphasizes the human side of security rather than the technical (Wikipedia). The idea is older than most of the tools it studies. Jerry Saltzer and Michael Schroeder listed “psychological acceptability” among their design principles in 1975, and the view that security and usability are at odds persisted anyway (Wikipedia).
“We did, for example, studies with over 1,000 people to find which kind of key fingerprints compare best.”
Dominik Schürmann, at 3:35
Which kind of key fingerprints compare best
Jon asked about the results. Dominik called it one of his best papers.
“This was one of the USENIX Security papers I did with a colleague of mine.”
Dominik Schürmann, at 3:57
A key fingerprint is a short sequence of bytes, made by hashing a public key, that people compare to check they have the right key (Wikipedia). Dominik listed the three common ways to show one: hexadecimal, as in PGP, numbers, as in Signal, and words, like the backup phrases for Bitcoin wallets.
“So a lot of different ways, but they all have some upsides and downsides.”
Dominik Schürmann, at 4:22
Phrases, for instance, only work in English, he said, which is why Signal went with numbers.
The paper is “An Empirical Study of Textual Key-Fingerprint Representations,” presented at the 25th USENIX Security Symposium in Austin in August 2016 by Sergej Dechand, Dominik Schürmann, Karoline Busse, Yasemin Acar, Sascha Fahl and Matthew Smith (USENIX). It tested six textual representations with 1,047 participants. Hexadecimal, the widely used format, was more vulnerable to partial preimage attacks, a sentence-based format had “the highest attack detection rate and best usability perception,” and where a language-based format won’t work, plain numbers still beat hexadecimal (USENIX). Signal asks users to compare fingerprints out of band, and one study found 21 of 28 participants failed to compare them correctly (Wikipedia). USENIX, which runs the symposium, is a nonprofit founded in 1975 in Berkeley (Wikipedia).
Sergej Dechand, the paper’s first author, was the guest on episode 21 of this show, as co-founder and CEO of Code Intelligence.
Security people are trained to think like an attacker
Jon asked whether a truth had emerged from those years that most people hadn’t noticed. Dominik had thought about the question in advance.
“Security people are trained to think like an attacker, and that means they are always trying to find corner cases.”
Dominik Schürmann, at 5:26
“Like, this is a very specific attack, and this means the system is not secure.”
Dominik Schürmann, at 5:34
“So all these, like, these sorts of processes lead to extreme choices in security protocols, especially if you design security protocols by a committee.”
Dominik Schürmann, at 5:39
That training shows up in threat modeling, the process of identifying and listing potential threats and prioritizing the countermeasures (Wikipedia). Dominik’s point is about what happens next. If every corner case has to be closed, the protocol gets harder to build and harder to use.
Death by committee
Jon’s reaction to the word committee was two short groans.
“Oh no, by a committee, oh no.”
Jon McLachlan, at 5:55
“That’s why some people call it death by committee.”
Dominik Schürmann, at 5:59
Design by committee is the pejorative term for a project with many designers and no unifying plan or vision (Wikipedia). His example was close to home.
“In Germany, there’s a lot of examples, like the ID cards in Germany.”
Dominik Schürmann, at 6:04
“It’s some very interesting cryptography involved, but it’s so difficult to implement that these ID cards don’t work with most of Android phones, and they don’t work with most card readers.”
Dominik Schürmann, at 6:09
Germany’s electronic ID card dates to November 2010. It carries a contactless chip, and using it to log in online takes a six-digit PIN, with a PUK to unlock it after three wrong tries (Wikipedia). Which phones and readers work with it is Dominik’s account at the time of the recording.
“So I think this is a bad way to go at security protocols.”
Dominik Schürmann, at 6:22
OpenKeychain, which still has 300,000 users
The second example was his own. For several years he maintained a PGP app for Android.
“It’s called OpenKeychain, which still has 300,000 users.”
Dominik Schürmann, at 6:41
He came at it with the same mindset, he said: take care of every attack scenario. That led to no adoption. The insight he took from it is to find a trade-off, because security measures that prevent adoption don’t help anyone.
OpenKeychain is a free and open-source Android app for encryption compatible with the OpenPGP standard, used to encrypt, decrypt, sign and verify text, email and files (Wikipedia). It began in March 2012 as a fork of Android Privacy Guard, released version 2.0 in January 2013, and was listed on the OpenPGP homepage and recommended by the Guardian Project. Since August 17, 2021 it has been in maintenance mode, because its maintainers concluded that offering its features as an app rather than as a library had been a misguided decision (Wikipedia). The 300,000 users are Dominik’s count at the time.
If nobody uses it
Jon put the argument in one line.
“You have the most secure piece of software or hardware in the world, and if nobody uses it, are we really making a difference in the world?”
Jon McLachlan, at 7:13
Dominik agreed, and went straight to an example.
The next PGP version
“PGP is one of the worst examples, and it’s not getting better.”
Dominik Schürmann, at 7:26
“I’m a little bit following the current standardization process of the next PGP version”
Dominik Schürmann, at 7:32
His verdict on it, from a distance, was “it’s a disaster.”
Phil Zimmermann developed PGP in 1991 for signing, encrypting and decrypting text, email and files (Wikipedia). PGP itself follows the OpenPGP standard in RFC 4880, a version Wikipedia now calls historical, and doesn’t support the updated formats in RFC 9580 (Wikipedia). Jon gave the standards people their due.
“I know it’s very easy to get sucked into rabbit holes.”
Jon McLachlan, at 7:59
Dominik knows most of them personally, he said, from meetings of the people who build PGP into their products.
“We had a lot of meetings of all the PGP implementation people, like the Thunderbird guys, then the Proton Mail people.”
Dominik Schürmann, at 8:08
“Just my point of view now is they’re prioritizing the wrong stuff.”
Dominik Schürmann, at 8:23
Thunderbird is the free and open-source email client made by MZLA Technologies, a subsidiary of the Mozilla Foundation (Wikipedia), and Proton Mail is the end-to-end encrypted email service launched in 2014 in Geneva (Wikipedia).
It’s not fixable
Jon asked whether this was what nudged him toward heylogin. It was, and it’s also where he met his co-founder.
“My co-founder then also got involved in this project.”
Dominik Schürmann, at 8:46
“And we always try to innovate on this very broken standard.”
Dominik Schürmann, at 8:53
“And at one point, we just thought, okay, it’s not fixable.”
Dominik Schürmann, at 8:58
“Let’s do something else where we can design everything from the ground up.”
Dominik Schürmann, at 9:03
heylogin’s about page names the co-founder: Vincent Breitmoser, the CTO, who led end-to-end encryption projects for K-9 Mail and XING chat, ran keys.openpgp.org, and co-founded Stratum0, the Braunschweig hackerspace (heylogin). K-9 Mail is a free and open-source email client for Android (Wikipedia). The same page says the company grew out of their encryption research and their work as security consultants, where they saw customers keep passwords on sticky notes and in spreadsheets (heylogin).
1Password is 16 years old now
Password managers, Dominik said, are the same kind of problem as PGP: a concept that hasn’t changed much since it started.
“Like, 1Password is 16 years old now.”
Dominik Schürmann, at 9:21
“So in the IT world, that’s a long time.”
Dominik Schürmann, at 9:26
A password manager stores usernames and passwords in a vault, and the vault’s encryption key is commonly derived from a master password (Wikipedia). 1Password, from the Canadian company AgileBits, locks its vault with a master password and by default keeps it on 1Password’s servers for a monthly fee (Wikipedia). That master password is the thing heylogin set out to remove.
110 software as a service platforms
The business case was the number of logins. Dominik had just seen a statistic, he said, that B2B companies use 110 software as a service platforms on average. He didn’t name the source, so the number is his account.
Any of them that can’t be connected to single sign-on, he said, needs a password manager.
The market is growing, he said, and yet the tools are still built for the IT department.
“the tools are still targeted to an IT audience.”
Dominik Schürmann, at 10:08
“heylogin focuses on usability, and that’s why we think differently in a lot of aspects of password management.”
Dominik Schürmann, at 10:17
Single sign-on lets a person log in once, with one ID, to several related but independent systems (Wikipedia). Software as a service began around 2000 and by 2023 was the main way software was deployed (Wikipedia). Every app that can’t be connected to single sign-on is another password someone has to keep. The calculator below counts yours, starting from his 110.
Security through usability
Jon summed up the pitch in his own words.
“So heylogin is a password manager that is obsessed with the usability of the experience and trying to aim for security through usability.”
Jon McLachlan, at 10:26
“Because once you get the usability, you get the adoption, you get the ease of use, you are actually taking the burden off the shoulder of the user.”
Jon McLachlan, at 10:41
The argument comes back on this show. Taher Elgamal, who designed SSL, explained on episode 61 why the login page ended up with a password, and Riad Wahby built a company on hardware-backed keys around the idea that security versus speed is a false choice, on episode 69.
The master password on a piece of paper
Dominik’s evidence came from consulting work in 2018 and 2019, before heylogin.
“So one of our experience during our time as consultants in the early years, like 2018, 2019, was that even if companies deploy a password manager, their employees which are forced to use it just write down the master password on a piece of paper and put it on their desk.”
Dominik Schürmann, at 10:51
It’s the same problem as having no password manager, he said, moved to a different tool.
Jon named what the paper means in security terms.
“and now in security terms, you have a single point of failure for all your passwords.”
Jon McLachlan, at 11:28
Most people don’t enable it
The second problem, Dominik said, is that a master password is one factor.
“And it’s still a one-factor solution.”
Dominik Schürmann, at 11:34
“If you just use the master password, it’s just one factor, something you know, so knowledge.”
Dominik Schürmann, at 11:38
1Password and its competitors offer two-factor security as an option, he said,
“but most people don’t enable it.”
Dominik Schürmann, at 11:49
“So it’s not like there is a huge adoption of these options.”
Dominik Schürmann, at 11:52
Multi-factor authentication grants access only after a person presents two or more distinct types of evidence, which protects an account from someone who has discovered a single password (Wikipedia). An option that most people leave off doesn’t do that. The same gap shows up in security questionnaires, where “MFA enabled” and “MFA enforced” are different answers, as our post Enabled Isn’t Enforced explains.
No master password, no password at all
So heylogin dropped the master password.
“And that’s where we are trying to think differently.”
Dominik Schürmann, at 12:05
“In heylogin, there is no master password, no password at all.”
Dominik Schürmann, at 12:09
“So it’s two-factor secure by default, and even easier, because you have just the factor of possession, the security chip in your smartphone, and the second factor is the PIN or face unlock or fingerprint.”
Dominik Schürmann, at 12:19
heylogin’s security architecture page describes the design. Vaults are encrypted with the security chips of the user’s devices. When the browser extension needs a vault, it asks the phone, the chip is unlocked locally with a fingerprint, face or PIN, and the device’s seed reaches the extension end-to-end encrypted. The extension derives its key pairs and discards the seed, and the cloud only stores the encrypted data and, in heylogin’s words, “has no ability to decrypt the vaults” (heylogin). The page names XSalsa20 and Poly1305 for encryption and Curve25519 for key exchange, and says vaults are also encrypted to administrators’ chips, so a company can recover access when a device is lost without admins reading personal vaults (heylogin).
A secure cryptoprocessor is a dedicated chip for cryptographic operations, packaged with physical security measures that make it tamper resistant, and it doesn’t hand decrypted data to an environment it can’t trust (Wikipedia). Our post on device-bound credentials explains why secrets that never leave that kind of hardware are hard to steal.
The PIN is bound to your security chip
Jon liked the convenience of a face or fingerprint. Dominik made the case for the PIN too: it’s more secure than a master password, he said, because of where it lives.
“the PIN is bound to your security chip in your phone, and there is a limited number of tries.”
Dominik Schürmann, at 13:04
A PIN is short. What makes it work is the hardware around it. The chip that holds the key also counts the tries, so a thief can’t keep guessing, and the key can’t be copied off the phone to guess against somewhere else. Germany’s ID card uses the same pattern, with a six-digit PIN and a PUK after three wrong tries (Wikipedia).
Swipe to login
Jon asked the practical question. How does a 100-character password get from the phone into Safari on a laptop? Dominik warned that a full answer would be a deep dive, and Jon asked for just a tease.
“There are several cryptographic keys involved here, but let me just say the most important key is the one that is generated at first-time use inside the security chip of your phone, and this key cannot be extracted from your phone.”
Dominik Schürmann, at 13:39
“from this key, we derive several other cryptographic keys for different purposes.”
Dominik Schürmann, at 13:56
Then the flow. You click a button on the site in your laptop’s browser, and a notification comes up on your phone.
“On your phone, you can just swipe to login.”
Dominik Schürmann, at 14:15
That’s what they call it, swipe to login.
“And then you’re logged in on the desktop.”
Dominik Schürmann, at 14:24
Once per day
The swipe isn’t needed for every login.
“And when you’re doing this, you just need to do it once per day.”
Dominik Schürmann, at 14:28
After the swipe, he explained, a temporary key is generated for that browser for that day, and the browser keeps access until the phone revokes the key.
“So we don’t need to transmit all passwords from the phone to the browser.”
Dominik Schürmann, at 14:51
“It’s a little bit more complicated, but that allows us better responsiveness.”
Dominik Schürmann, at 14:56
Jon liked the expiry.
“So it sounds like we’ve got a very high security bar here, and things are expiring on a 24-hour basis, which is amazing.”
Jon McLachlan, at 15:03
“I do like that, because then now my computer is much more secure, in the sense that any sensitive data is going to have a TTL, essentially.”
Jon McLachlan, at 15:18
“You can always also open the app on your phone and revoke at any time you like, if you don’t like to follow the 24-hour protocol.”
Dominik Schürmann, at 15:32
Time to live is a mechanism that limits the lifespan of data in a computer or network. Once the set time has passed, the data is discarded or revalidated (Wikipedia). A browser key that dies at the end of the day limits what a stolen laptop is worth to a thief.
Bottom-up
Jon asked about go-to-market. B2C or B2B, top-down or bottom-up?
“Bottom-up.”
Dominik Schürmann, at 15:50
“So, I mean, 1Password, LastPass, Dashlane, they all have a private user plan.”
Dominik Schürmann, at 15:50
“We currently don’t have a private user plan, because our private user plan is free.”
Dominik Schürmann, at 15:56
“I don’t think there is a lot of market left for B2C in this space.”
Dominik Schürmann, at 16:05
Jon called it saturated. The people who pay for a password manager already have one, he said, and they won’t easily switch to another paid one.
“They don’t easily switch to another paid password manager, but they may switch to a free plan and a better password manager.”
Dominik Schürmann, at 16:24
“So it’s kind of like the typical product-led growth strategy, where you have a freemium plan and then do an upsell.”
Dominik Schürmann, at 16:36
The money is in the B2B plan. Freemium is the pricing strategy where a basic product is free and money is charged for features that expand it, used in software since the 1980s (Wikipedia). The competitors he named are older. LastPass was founded in 2008, bought by LogMeIn, now GoTo, for $110 million in 2015, and breached in late 2022 (Wikipedia). Dashlane was founded in Paris on July 6, 2009 (Wikipedia).
So easy to use that it doesn’t feel so secure
Jon asked for the best day so far. Dominik picked a week.
“Yeah, so when we got the first reviews of our B2B features, it was quite a great week.”
Dominik Schürmann, at 17:04
“So that kind of proved our strategy and our usability.”
Dominik Schürmann, at 17:25
They printed one review and hung it on the wall. The reviewer loved the product.
“He said it’s like the best user experience ever.”
Dominik Schürmann, at 17:47
And then the last line of the review.
“it’s so easy to use that it doesn’t feel so secure.”
Dominik Schürmann, at 17:53
“So it’s quite funny, because it’s a compliment at the same time.”
Dominik Schürmann, at 18:00
Jon’s read was that people have been trained to expect security to hurt.
“It’s going to be an impediment to the flow of your day, a roadblock, an obstacle, or something.”
Jon McLachlan, at 18:19
Tesla’s first car was basically a race car
Jon’s comparison was a car.
“You know, I imagine this is why Tesla, the very first car that they built, was basically a race car.”
Jon McLachlan, at 19:05
“You know, they’re trying to break the stereotype: electric cars are slow, less of a car, whatever.”
Jon McLachlan, at 19:12
Break the stereotype with a very fast car, he said, then build the sedan, and do the same for security in password management. The first-generation Tesla Roadster was a battery electric sports car based on the Lotus Elise chassis, produced from 2008 to 2012, and it went from 0 to 60 miles per hour in 3.7 or 3.9 seconds (Wikipedia). The four-door Model S, the company’s second vehicle, went into series manufacture in June 2012 (Wikipedia).
Fear marketing
Dominik added a second side to the same idea.
“There is even the side of marketing.”
Dominik Schürmann, at 20:00
“So IT security products are often sold with what I call fear marketing.”
Dominik Schürmann, at 20:02
“People should fear data leaks.”
Dominik Schürmann, at 20:09
“Like, the most costly ad Dashlane ever ran was a Super Bowl ad.”
Dominik Schürmann, at 20:18
In the ad as he remembers it, a man dies, arrives in heaven, and is asked for his password. The ad and its cost are his account. heylogin’s answer is a different pitch.
“So that’s why we try to go the way of showing how heylogin provides more productivity for your employees.”
Dominik Schürmann, at 20:52
Jon agreed.
“I’ve never really seen it pay off in any long-term success.”
Jon McLachlan, at 21:05
The worst day
Jon asked for the worst day. Dominik went back to the start of heylogin.
“So, you know, when we started developing heylogin in March 2020, we were able to start with a grant.”
Dominik Schürmann, at 21:17
“We got a big grant from the German government that was pretty great to do the development.”
Dominik Schürmann, at 21:25
As the grant ran down, they went looking for a first venture capital round.
“And we were pretty confident that it shouldn’t be a problem.”
Dominik Schürmann, at 21:40
“We had a pitch at a very, very local VC.”
Dominik Schürmann, at 21:48
It was the fund for their own state, Lower Saxony, and partly governmental, he said, and the money didn’t come. Looking back, he called the confidence naive.
“So that was a really bad experience, and it kind of grounded us.”
Dominik Schürmann, at 22:10
“So, yeah, I was down for a week at least.”
Dominik Schürmann, at 22:14
Lower Saxony is a coastal state in northwestern Germany (Wikipedia), and Braunschweig, where heylogin has its headquarters, is one of its cities (Wikipedia, LinkedIn). Jon thanked him for telling it. Those are vulnerable moments, he said,
“not just for companies, but for the leaders in those companies too.”
Jon McLachlan, at 22:38
A crash course
Taking in the feedback and starting a new round took a long time, Dominik said.
“There was a lot of stuff that we needed to learn before.”
Dominik Schürmann, at 22:53
“So we took an external consultant for this specific round, and then it took some months until we started talking to VCs again, and then we were better prepared.”
Dominik Schürmann, at 22:57
Jon called it a crash course in an MBA.
“we had like three meetings per week with this consultant.”
Dominik Schürmann, at 23:20
“So, yeah, it was kind of a crash course.”
Dominik Schürmann, at 23:23
A very conservative finance plan
Jon asked what success looks like. Dominik answered with a plan.
“Yeah, so currently we have a very conservative finance plan.”
Dominik Schürmann, at 23:47
The plan was to be cash flow positive the following year without a lot of growth, and he was hesitant to raise another round in the venture market of the time. Jon pointed to the responsibility that comes with it.
“I mean, being a leader of a company, there’s people that depend on you for their livelihood”
Jon McLachlan, at 24:46
Nine pregnant women don’t make a baby in a month
The plan held the engineering team steady.
“The development team stays the same after a current round.”
Dominik Schürmann, at 25:05
One more developer, he said, doesn’t make product development faster.
“So what we do is put our money into sales and marketing and keep the current headcount in development.”
Dominik Schürmann, at 25:21
Jon reached for the old line about software schedules.
“that nine pregnant women don’t make a baby in a month.”
Jon McLachlan, at 25:36
The phrase comes from Brooks’s law, Fred Brooks’s observation in his 1975 book The Mythical Man-Month that “adding manpower to a late software project makes it later” (Wikipedia). Jon added that he wished there were a gender-neutral version.
It’s not like Sequoia
Jon asked whether the investors pushed for more hiring and spending. Dominik described a mix.
“I think we have a pretty interesting combination of business angels and one bigger brand.”
Dominik Schürmann, at 26:06
The angels are very local, he said, and the brand is Mozilla. The angels have a German perspective and are happy with cash flow positive.
“They don’t necessarily plan for growth.”
Dominik Schürmann, at 26:38
Mozilla, he said, isn’t like Sequoia or another venture firm, and there wasn’t a lot of pressure. Mozilla announced Mozilla Ventures on November 2, 2022, at Web Summit in Lisbon, with a starting fund of $35 million, and named HeyLogin among its first three investments (Wikipedia). heylogin dates the investment to fall 2022, in a pre-seed round alongside German business angels (heylogin), and its press page puts the round at €900,000 (heylogin). Sequoia Capital is a venture firm in Menlo Park, California, that invests from seed to growth stage (Wikipedia).
“So this is a good thing, and I’m happy for you”
Jon McLachlan, at 27:24
Fail fast is only partly right
Jon’s last question was the advice Dominik wishes he had heard younger. He took on a Silicon Valley favorite.
“there is this idea of fail fast and try a lot of things and go to market early.”
Dominik Schürmann, at 28:02
“I think it’s only partly right.”
Dominik Schürmann, at 28:11
His example was Figma, which took years of trying different things before it settled on a product, and then more time to build a basic version.
“So after trying a lot of stuff, you should at one point stick to something.”
Dominik Schürmann, at 28:28
“And then it takes some time until you get the first user base.”
Dominik Schürmann, at 28:33
Fail fast is the management idea that people should use trial and error to judge a product or strategy quickly and move on, and it’s part of the culture of Silicon Valley (Wikipedia). Figma, Inc. was founded in 2012 by Dylan Field and Evan Wallace, and its first public release came on September 27, 2016 (Wikipedia). Jon added the obvious footnote, maybe a pivot or two, and Dominik agreed. If you look closely, he said, heylogin has had more than one, and the big one was in March 2020.
In the market for a new password manager
Jon closed with his own situation. He was shopping for a password manager, because his 1Password had dropped the peer-to-peer sync between his own devices in its latest version.
“And I just don’t want my stuff in their cloud with only a password protecting it.”
Jon McLachlan, at 29:22
“So, long story short, I’m in the market, and I’m definitely going to give heylogin a try.”
Jon McLachlan, at 29:27
Wikipedia records the change: 1Password 8 removed the option to store vaults locally, which drew criticism, and syncing over the local Wi-Fi was only in earlier versions (Wikipedia). Jon invited listeners to try it too.
“To be a small part of that journey, to be a small part of history.”
Jon McLachlan, at 29:48
After the tape
heylogin’s LinkedIn page lists it as founded in 2020, with headquarters in Braunschweig and 11 to 50 employees (LinkedIn). Its website now says logins can be confirmed with the phone app’s swipe to login, a FIDO2 security key, Touch ID, Windows Hello or a smartwatch, lists passkeys and two-factor codes among its features, and says heylogin GmbH is ISO 27001 certified (heylogin). A passkey is a key pair created by the user’s own authenticator, built on standards from the FIDO Alliance and the W3C’s WebAuthn (Wikipedia), and the FIDO Alliance launched in February 2013 to reduce the world’s reliance on passwords (Wikipedia).
The press noticed before the episode aired. heise online tested heylogin in January 2023 (heise online), and Golem.de wrote about the password manager that needs no password itself in June 2023 (Golem.de).
Dominik still makes the argument from the show. In September 2026 he wrote that a password manager isn’t automatically more secure because it can fend off more attacks, and that it’s only secure once as many people as possible actually use it.
Ein Security-Feature, das niemand nutzt, ist nur eine weitere Zeile im Whitepaper.
Dominik Schürmann · September 4, 2026
It’s the OpenKeychain lesson, three years after the episode: security that people don’t use doesn’t help.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
What did heylogin start as in 2018?
- COTECH
- OpenKeychain
- Stratum0
a. "So actually, we started as COTECH in 2018." Transcript, 1:13.
-
How many people took part in Dominik's key fingerprint studies, as he put it on the tape?
- Over 100
- Over 1,000
- Over 10,000
b. "We did, for example, studies with over 1,000 people to find which kind of key fingerprints compare best." Transcript, 3:35.
-
What do some people call security protocols designed by a committee?
- Security theater
- Defense in depth
- Death by committee
c. "That's why some people call it death by committee." Transcript, 5:59.
-
What takes the place of the master password in heylogin?
- A longer passphrase
- The phone's security chip, plus a PIN, face or fingerprint
- A code sent by text message
b. "So it's two-factor secure by default, and even easier, because you have just the factor of possession, the security chip in your smartphone, and the second factor is the PIN or face unlock or fingerprint." Transcript, 12:19.
-
How often do you swipe to log a browser in?
- Once per day
- For every login
- Once per week
a. "And when you're doing this, you just need to do it once per day." Transcript, 14:28.
-
What did the review on heylogin's wall say at the end?
- That setup took too long
- That it was too expensive for a small team
- That it was so easy to use it didn't feel secure
c. "it's so easy to use that it doesn't feel so secure." Transcript, 17:53.
-
Which bigger brand invested alongside heylogin's local business angels?
- Sequoia
- Mozilla
- Proton
b. "I think we have a pretty interesting combination of business angels and one bigger brand." The brand is Mozilla. Transcript, 26:06.
Does your security get adopted?
Dominik’s test for a security measure is whether people use it. Eight questions on whether yours pass.
Scorecard · eight questions
Does your security get adopted?
Answer for how your company works today. If two answers fit, pick the lower one.
-
Do the security tools you pick work for people outside IT, not just for the IT team?
- Only IT can use them
- Some of them
- Yes, we pick tools everyone can use
"the tools are still targeted to an IT audience." See 110 software as a service platforms.
-
If you've rolled out a password manager, do people use it without writing the master password down?
- We don't have one, or we don't know
- We think so, but we don't check
- Yes, and we check
"their employees which are forced to use it just write down the master password on a piece of paper and put it on their desk." See The master password on a piece of paper.
-
Is two-factor enforced, not just offered, on the accounts that matter?
- It's optional
- Enforced for admins
- Enforced for everyone
"but most people don't enable it." See Most people don't enable it.
-
Do your logins rely on something people have, like a phone's security chip or a security key, and not only on something they know?
- Passwords only
- For some apps
- Yes, by default
"the PIN is bound to your security chip in your phone, and there is a limited number of tries." See The PIN is bound to your security chip.
-
Does access on a laptop expire on its own, and can people revoke it from their phone?
- Sessions last until someone notices
- Some expire
- Yes, short-lived and revocable
"You can always also open the app on your phone and revoke at any time you like, if you don't like to follow the 24-hour protocol." See Once per day.
-
Before a security control ships, do you try it with the people who will have to use it?
- No
- After launch, if people complain
- Yes, before it ships
"My research was always like finding trade-offs between usability and security." See Trade-offs between usability and security.
-
Do you track how many people use each security tool, and not just whether it's deployed?
- No
- For a few tools
- Yes, every tool has an adoption number
"You have the most secure piece of software or hardware in the world, and if nobody uses it, are we really making a difference in the world?" See If nobody uses it.
-
When you ask people to adopt a security tool, do you lead with the time it saves them rather than with fear?
- Mostly fear
- A mix
- Mostly the time it saves
"So IT security products are often sold with what I call fear marketing." See Fear marketing.
Your controls look good on paper, and people are probably working around them. This month, list the apps outside single sign-on, enforce two-factor on admin accounts, and ask ten people how they really log in.
The basics are in place for some people. Next, enforce two-factor for everyone, move the important logins to something people have, like a phone's chip or a security key, and give laptop sessions an expiry.
Your security is built to be used. Keep measuring adoption for every tool, test new controls with the people who use them before they ship, and keep pitching security as time saved.
How many logins live outside your single sign-on?
Dominik’s statistic was 110 SaaS platforms at the average B2B company. This calculator starts there and counts the logins that single sign-on doesn’t cover. Every default besides the 110 is our example, not a benchmark.
Calculator
How many logins live outside your single sign-on?
Four numbers: the SaaS apps your company uses, the share behind single sign-on, the share a typical person uses, and how many people you have.
With 110 apps and 40% behind single sign-on, 66 apps still need their own logins. If a typical person uses 30% of them, that's about 20 passwords each, or 990 across 50 people.
The 110 is the statistic Dominik cited on the tape for B2B companies on average. The 40%, the 30% and the 50 people are our examples, not benchmarks. Put in your own.
From psychological acceptability to swipe to login
Everything on this page sits on one timeline, from a 1975 design principle to Dominik’s post in 2026. Filter it by thread.
Timeline · 1975 to 2026
From psychological acceptability to swipe to login
Filter by thread. Dates are from the public record except where marked as Dominik's account or part of this show.
- Psychological acceptability
Jerry Saltzer and Michael Schroeder make usability a security design principle (Wikipedia, on this show).
- The Mythical Man-Month
Fred Brooks coins the law about adding people to a late software project (Wikipedia, on this show).
- PGP
Phil Zimmermann develops Pretty Good Privacy (Wikipedia, on this show).
- The BSI
Germany's Federal Office for Information Security is founded in Bonn (Wikipedia, on this show).
- LastPass
The password manager is founded (Wikipedia, on this show).
- Tesla Roadster
Production of the electric sports car begins and runs to 2012 (Wikipedia, on this show).
- Dashlane
The password manager is founded in Paris (Wikipedia, on this show).
- The electronic ID card
Germany's ID card gets a chip and a six-digit PIN for logging in online (Wikipedia, on this show).
- OpenKeychain
The Android app starts as a fork of Android Privacy Guard (Wikipedia, on this show).
- Aalto University
Dominik's first stay as a guest researcher, on delay-tolerant networks (LinkedIn, on this show).
- Model S
Series manufacture of Tesla's second vehicle begins (Wikipedia, on this show).
- Figma, Inc.
Dylan Field and Evan Wallace found the company (Wikipedia, on this show).
- OpenKeychain 2.0
The app releases version 2.0 (Wikipedia, on this show).
- The FIDO Alliance
Launched to reduce the world's reliance on passwords (Wikipedia, on this show).
- TU Braunschweig
Dominik becomes a research associate at the Institute for Operating Systems and Computer Networks (LinkedIn, on this show).
- LastPass sold
LogMeIn, now GoTo, buys it for $110 million (Wikipedia, on this show).
- Freelance cryptography
Dominik starts analyzing and developing cryptographic protocols for the BSI and ENISA, until 2018 (LinkedIn, on this show).
- Key fingerprints at USENIX Security
The study of 1,047 participants is presented in Austin (USENIX, on this show).
- Figma's first public release
Four years after the company was founded (Wikipedia, on this show).
- Aalto again
A DAAD scholarship, for research on gait-based pairing of mobile devices (LinkedIn, on this show).
- COTECH
Dominik co-founds the company that becomes heylogin (LinkedIn, on this show).
- The big pivot
Development of heylogin starts on a government grant, by Dominik's account (LinkedIn, on this show).
- Maintenance mode
OpenKeychain goes into maintenance mode (Wikipedia, on this show).
- Mozilla invests
Mozilla Ventures joins German business angels in heylogin's pre-seed round (heylogin, on this show).
- Mozilla Ventures
Announced at Web Summit in Lisbon with $35 million, naming HeyLogin among its first three investments (Wikipedia, on this show).
- The LastPass breach
Attackers reach LastPass user data and vaults (Wikipedia, on this show).
- heise online's test
A review of the password manager without a master password (heise online, on this show).
- Golem.de
A story on the password manager that needs no password itself (Golem.de, on this show).
- Episode 30 airs
On Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- A security feature nobody uses
Dominik's post on usable security (LinkedIn, on this show).
What to do this week
Five things, in the order the episode suggests.
- Find out whether your security gets used. Take the scorecard with whoever owns IT and whoever owns security, and compare answers.
- Count the logins outside single sign-on. Run the calculator with your real numbers, then connect what you can and give everyone a password manager for the rest.
- Enforce two-factor, don’t just offer it. An option most people never turn on doesn’t protect them. Our post Enabled Isn’t Enforced has the checks.
- Move the important logins into hardware. Passkeys and keys bound to a device’s security chip can’t be written on a sticky note. Our post on device-bound credentials has a rollout plan.
- Get help with the parts you can’t staff. Our Product Security team helps build security your users will adopt, our Penetration Testing team tests what an attacker would try, a vCISO can own the program, our Sales Support team answers the security questionnaires, and you can book 15 minutes with us.