Clef

» see getclef.com as it lived, on the wayback machine

~ the goodbye ~

Clef replaced the password with a camera. You opened the app on your phone, pointed it at your laptop screen, and a set of colored bars animating in the browser got matched against the same pattern animating in your hand. If they lined up, you were in. There was nothing to type and no six digit code to copy across from one device to the other. The company called the animation the Clef Wave, and the orange bars from it ended up as the app icon.

It was founded in San Francisco in 2013 and raised $1.6 million in seed funding in November 2014. The growth came almost entirely through WordPress. Clef shipped a plugin that bolted the wave onto any WordPress login screen, it was free, and by the end it was running on over a million active installations. That is a serious footprint for a login method almost nobody outside that world has heard of.

A million free installs is not a business, which is the whole story in one line. An SEC filing in September 2016 showed a raise that did not complete at an $8 million valuation cap. On 6 March 2017 the company announced it was done, giving the product three months of full operation with a final date of 6 June. Cofounder B Byrne put it plainly: they were not able to find a business model that would make the growth sustainable. The team went to Twilio and joined Authy, the two-factor service Twilio already owned, with Byrne taking over as product lead on the Authy API.

~ the chronicle ~

~ how the wave worked ~

The clever part was that the phone never sent a photograph anywhere. The animating bars carried a short changing value identifying the login attempt in front of you, and the app read that value off the screen and authorized the session using the key held on the handset. The screen was only a channel for the challenge, which is why the whole thing finished in about a second and why the two devices never had to be on the same network.

Two-factor authentication reached me the way it reached most people in Turkey, through a bank. The SMS one time code was everywhere here years before anything like Clef existed, and once a country learns a security habit from its banks, that habit is very hard to replace with something better looking. Clef's natural customer was somebody who administers a WordPress site and can also persuade every other person with a login to install an app. In Turkey that second half was the hard part.

~ the extra month ~

The published death date was 6 June 2017 and the real one was not. By 8 June the notice had changed, saying Clef would keep working until 7 July and pointing people at Jetpack's own two-factor authentication on the way out. Wikipedia and most of the trade coverage still carry the June date, because the announcement got written about and the one line amendment did not. The apps came out of the Play Store and the App Store when the extension expired.

~ what Twilio got ~

No money changed hands for the product. Twilio hired the people, Authy absorbed the expertise, and Clef itself was switched off rather than folded into anything. The WordPress plugin was pulled from the directory and the sites that depended on it had to find a replacement in a few weeks, which for most of them meant a plain numeric code generator.

getclef.com still resolves. It answers a permanent redirect to rublon.com, an unrelated multi factor authentication company that picked up the domain years later. The wave is gone from the web entirely, and the clearest surviving picture of it is the plugin icon still sitting on WordPress.org's asset server: four orange and yellow bars at different heights, mid animation.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »