ETacts (YC W10) will help you manage your relationships

That's a fine security page (except that it needs to be clear that you're holding on to gmail passwords). But, please remember: if you don't have a security response page, which tells people how to contact you if they find a horrible security problem in your application, they are within our cultural norms to write a very unpleasant blog post about you.

Well, I've got good news and bad news. The good news is I want to use your service. If it works the way it looks like it works, I'd pay you to use it. I'm guessing a lot of other people will think the same thing. That's huge!

The bad news is that "bank-level" encryption and assertions of good intentions are not sufficient for me to give you my Google password. My Google password is one of two that is not recorded anywhere. The second is for the vault that contains my other 575 passwords. I almost edited my original post to be less melodramatic, but on reflection I think it's right. For a cool grand, I would spend the time to completely separate the associated accounts (analytics, webmaster, docs, calendar, talk, voice) and any password reminders that forward into my gmail now into a separate account. Short of that, I just can't do it. I'm selfishly hopeful that Google gives you a way in without needing to store my password.

It's interesting that of all the various Google Data API's (which many use OAuth, I believe) Gmail isn't one of them. I guess that makes sense, since there are protocols like IMAP and POP... but for something like this it would be nice.

The Google Contact API supports OAuth, which is fantastic because so many sites want your email address and password to get contacts (for like invite friend style functionality) but it doesn't appear they store any kind of communication frequency data.

I would rather prefer to type-in my contact list than handing over my password. Why don't you make that option available?

How about an option where the user enters their credentials once per day (or however often they like), directly feeding the polling process, so that their credentials aren't stored?

OK. So you use encryption. +1

Have you had a vulnerability assessment done? Do you protect against SQL Injection? Do you protect against Cross-Site Scripting? How about Cross-Site Request Forgery? What preventative measures have you taken to lock down your servers?

I know most users don't care about all of those and you're trying to be friendly by saying you use "bank-level" encryption, but some more info would be nice for those of us that care.

You're missing some basics. For example, I can find out easily what version of Apache/OpenSSH etc you are running (Apache/2.2.11 (Ubuntu) mod_ssl/2.2.11 OpenSSL/0.9.8g mod_wsgi/2.3 Python/2.6.2, OpenSSH 5.1p1). Please turn off the banners that advertise these things. Also, don't run your SSH server off of your Apache box. And use public keys instead of passwords.

You can consult this hardening guide written by the NSA for Red Hat: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf. Even though you're using Ubuntu, the same general principles apply. Follow that guide to the letter and you will be secure enough until you can afford to higher professional pen testers.

Note that the NSA guide doesn't cover web application security, so you'll need to take other steps to ensure that part of your business is secure.

That you store passwords in the first place is the problem. As a developer, I consider it to be borderline unethical to build such a system in the first place, as it is inherently insecure. Furthermore, it helps to train users that it is ok to enter your username and password into other sites - which makes it easier for phishers and other sites that may have poor security.

>and your passwords are securely encrypted.

Just curious, what encryption scheme are you using?

You should release an app that people can self-host which provides a layer of indirection for IMAP. That is, an IMAP client/server I can run myself. I put my credentials in the client part, and give you an account in the server part. That way I don't need to give you my real credentials password.

Of course, this would limit the reliability of your service to the reliability of my connection, but that's a trade-off I'd be willing to make.

Promising to not be evil is not "doing something" in my opinion.

EVERY company in the world promises to not be evil. Not all of them keep their promise.

Somehow Mint convinced a million people to give them their bank logins. It probably just takes time, credibility, and a really attractive service. Though, hackers might never be your audience.

... and become the Xobni of Gmail?

Just throwing a thought out there: What about an option that allows people to use etacts without storing their password. So every time a user wants to "refresh" their data, they would have to re-enter their password.

The security advantages are limited– the password has to go through you guys either way– but there may be a difference psychologically.

I don't think mail2web would be as widely-used if they didn't have a policy against storing passwords.

Yeah and it should be changed soon.

@ETacts Again if you need any help let me know.

And we know where the MOTHER SOURCE TEMPLATE resides:

http://basecamphq.com/

You can't call this a 1-to-1 copy. Sure, when you look at them side by side, they have a lot of elements in common and use a similar color scheme. But for the most part these elements are common to a lot of websites in general. (e.g. Lighthouse by entp, or http://www.campaignmonitor.com/ and many more) Visual Website Optimizer was a 1-to-1 copy of Basecamp to the point where they were actually using the exact background image. But I'd say that at most Etacts was inspired by the general style of many websites/web-apps rather than Metalab in particular.

However, I had never looked at Basecamp vs. Ballpark (though I could tell that they both follow the same trends) and if Metalab were to call Etacts out for their design as jayair suggests, I'd like to hear Metalab's explanation for the copy of Basecamp's design and copy.

"The Better Way To Get Projects Done" => "The Better Way To Get Paid"; "See Plans and Pricing/30-day free trial, sign up in 60 seconds" => "See Plans and Pricing/30-day Free Trial. Get started in 60 seconds."

Anyway, what I'm trying to say is that Metalab does have a distinct style in a lot of their designs (they seem to love text-shadows for example) but they're not the inventors of it either. The layout is pretty common place nowadays. (or as lunaru put it about a year ago when Ballpark came out: "the layout is pretty much a de facto standard" http://news.ycombinator.com/item?id=557277)

At the time -- this was like 5-7 years ago -- I wasn't terribly interested in startups and doing school work or hanging out with my friends probably seemed like a better use of my time. I actually solved a lot of that problem on a later project where I needed to write parsers for the log formats of a bunch of IM/IRC clients, but now I really am not interested in getting reminders about who I haven't talked to.

What this sort of thing does really bring home for me is that in terms of trying to do a startup through y-combinator I should probably ignore whether I believe there is a market for something as long as I think some people would find it useful.

I think he's talking about the screenshot posted on techcrunch, which shows harj's real email.

please reach out to me when you are ready to discuss. My email is in the profile

Note - we are a company that hosts email on google apps. However, we can not and will not use this service through your website. However, something that we can host ourselves, and includes pricing that is friendly to small companies will be eagerly looked at.

Facebook frequently suggests to me people I haven't been in contact with for a while.

It's a box on the upper right side of the screen, with words such as "Reconnect to" or "Send a message to". All to friends one hasn't contacted in a while.