Things Andy Clymer Has Said on Podcasts

“SMS isn't a secure message service, right? It's a short message service. … We had an employee who lent his phone in a club for someone to make a call. Next morning, he woke up and found his bank account had been removed from his phone, and his whole account had been reset, because they just sent a password reset via SMS to his phone and that was it. SMS definitely improves security, but it's not the panacea by any stretch of the imagination.” — Andy Clymer, The Modern .NET Show

The host had just said to stop sending one-time codes by email. Andy goes further, saying SMS codes are also weak, and tells a story about a colleague whose bank account was reset after he lent someone his phone.

The Modern .NET Show · 2026-11-06 Permalink → Listen →

The Modern .NET Show Around 35:09 into the episode

Andy Clymer

…a solution that is solid and robust. And hopefully our customers don't have to worry about it because we're there every three months doing the maintenance, checking everything skewed and solid and all the packages are updated and there's no back door. So yeah, it's super important, I think. Yeah.

Jamie Taylor

…If I send an email from me to Andy, it needs to go through a bunch of servers. In order to get through those servers, the server has to read the entire email contents to be able to send it to the right place. It is not secure. Stop sending things that are like one-time codes through email, please.

Andy Clymer

I think it goes further than that. I think, you know, SMS is not secure message service, right? It's short message service. But, you know, and all the telcos hate the fact that all the banks have leveraged it, right? And again, trying to educate a lot of our customers to say, like, you know, SMS is super convenient, right? Pretty much every demographic in the UK, irrespective of age, understands SMS. Trying to get them to understand passkeys is a little bit more harder, but SMS isn't secure, right? And then we had an employee that lent his phone in a club for someone to make a call next morning, woke up and found that his bank account had been removed from these phone and he's had his whole account reset because they just sent a password reset via SMS on his phone and that was it. And they overdraft set and they cleared him out. And yeah, SMS is another terrible thing that, you know, it definitely improves security, but it's not the panacea by your search and imagination. Oh,

Jamie Taylor

yeah, absolutely. And this has quickly turned into how to phish people. But like, you don't even need to go that far. You don't need to be in a club and hand someone your phone to let them do something on it. If I know enough information about you, I can call your phone provider and have a new SIM…

Andy Clymer

Oh, 100%. Yeah. I dropped the

Jamie Taylor

SIM into my phone and then suddenly your SMS one-time passwords come to my device, not yours.

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

“We've made a very strong decision on Open Identity Server at the moment is that no code that gets committed is AI generated. But that's not to say that we're not using AI, because what we use AI for is for checking our work. … We implement the RFC by hand, using traditional software engineering techniques, and then we use AI in order to validate that what we've done matches the RFC.” — Andy Clymer, The Modern .NET Show

Asked how AI and agentic tools fit into building security software, Andy explains his team's policy of hand-written security code with AI as the reviewer, a rule that applies to outside contributors too.

The Modern .NET Show · 2026-11-06 Permalink → Listen →

The Modern .NET Show Around 40:52 into the episode

Andy Clymer

…got stolen. You can see it as a human. You probably try and help that person out. So yeah, I mean, SMS is nowhere near as secure as we probably thought it was. And yeah, and the only real true stuff nowadays is passkeys. And that's what we're kind of promoting as well with most of our customers.

Jamie Taylor

…cold face and you are writing things into the systems that everybody uses, you know how people say never write your own cryptographic library because even the PhDs, the people with multiple PhDs who do this get it wrong. Yeah, sure. I can't even imagine what it's like to be in security, you know?

Andy Clymer

Yeah, and that probably is a pretty good, I mean, one of the things I was kind of going to allude to at one point was, so AI is a massive thing. And, you know, our parent company is pushing AI very hard for us to adopt AI and get better, but get a throughput in terms of what we produce. We've made a very strong decision on Open Identity Server at the moment is that no code that gets committed is AI generated. But that's not to say that we're not using AI because what we use AI for is for checking our work, right? So, you know, we'll build a feature against a spec and plowing through an RFC trying to make sure you've covered every case is a painful process, right? So we often use, we build the implement the RFC, you know, by hand using, you know, traditional software engineering techniques. And then we use AI in order to validate that what we've done matches the RFC. Think that's been very useful, how that second set of eyes. I mean, we've seen that AI has been used all the time for like finding vulnerabilities. And that's how we're trying to use it, not to build the thing, the actual code, but we're actually using it to check our work effectively. And that's been…

Jamie Taylor

Yeah, absolutely. You've answered one of the questions that I was going to sort of come up with. And since, like, you know, everybody seems to be using LLMs, AI, Agentic Development, whatever you want to call it. We're not talking about vibe coding, folks, right? Or at least I'm not talking about…

Andy Clymer

Yeah, no. And, you know, I think we've heavily embraced the AI side of it, but we, we, like I said, we understand what we think. We still want to own the security side of it and make sure that we architect it and build it correctly and then just use it as that second, is that it's the check.…

Jamie Taylor

Yeah. And again, that kind of makes sense, right? Let's take the opinions of the tech industry and put them to one side, but acknowledge that those opinions exist, right? There are lots of people out there who are saying a machine can't possibly write code as well as a human. Absolutely. We're…

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

Things Andy Says on Podcasts

Where to Find Them

What They Said

Collections They Appear In