the_black_hand

Recently, left a startup job and so my options 3 month window till expiration kicked in. I took some time off between jobs to be with family/travel. I got back and recently started a new job that pays bi-weekly. My plan was to save some money each paycheck and exercise my options as money came. Unfortunately, all my option grants are on Carta. And Carta sucks so bad! I'm surprised this company is still in business WTF.

I submitted a first request thinking it would take max two to three days to complete the ACH like any normal business (it says 3-5 business days). It didn't. A few weeks pass, I'm getting close to my option expiration date. I get my next paycheck. So I figured let me submit my second batch and exercise my remaining options. The kicker: Carta doesn't allow multiple exercise requests! WTF! I wait and wait for the first exercise to complete. Apparently, the grant needs to be signed by multiple parties before the ACH even begins. It's been close to a month now, and my options expire tomorrow.

Like wtf, you have one job Carta! So I call Carta and ask them to expedite the process. They say my only option is to submit a manual request to my previous company to exercise. So I have to send them a mail/fax like it's the 80s. I'm out of the country on a trip and don't know how I can get the check to them by tomorrow.

Carta sucks kids! I get that cap tables are complex, but surely processing a payment shouldn't take months in 2024. Even if it does, it's inexcusable that they can't handle multiple requests at once.

I was visiting a friend abroad (tiny Poot country with bad internet- for context). One day her phone got stolen. She had her window cracked and the thief reached in and grabbed the phone from her hand in the middle of a call - nasty stuff.

I told her Apple’s encryption is quite good and her data was likely safe. She immediately set it to lost mode and successfully got a ping for a few seconds. The only issue was , like most people, her sim was unlocked. I told her this was the weak link, otherwise the phone itself would be secure. She went straight to the police and I told her to call he phone company to block the sim.

Unfortunately we were a bit too late. Public service is quite slow and transport isn’t great in this country so by the time we filed the police report and contacted the phone company , the attacker placed the sim in another phone and intercepted the text 2FA. Initially the thief tried phishing my friends contacts to reveal the password but none of them fell for it.

This struck me as very odd. It was just way too easy. Gmail passwords are probably the most important passwords for most people. Can you really change someone’s password with only their sim? Doesn’t Gmail ask for more forms of verification? Pets name, location history , other logged in devices etc… ? Im 100% sure the thief knew none of these. How could the thief place the sim in a new unidentified phone and successfully change the password with only access to the sim? Surely this must have set off all kinds of alarms bells with the fraud algos. I suspect she didn’t have other forms of 2FA but even then a series of basic questions about the account usage and history could have prevented this. I haven’t changed my password in a while, maybe I’m missing something.