11 ms·

Further, this behavior is quite common. Pretty much every mental health professional I know who engages in social media does so under a (light) pseudonym. Its t

Further, this behavior is quite common. Pretty much every mental health professional I know who engages in social media does so under a (light) pseudonym. Its their solution for maintaining a professional relationship with people who may not understand or respect that boundary. A great many teachers do too, for basically the same reason.

mhb 6y ago
How is this different than a security through obscurity argument which is so roundly discounted by virtually everyone who reads HN?
- someone7x 6y ago
  Doesn’t he admit as much in the article? He doesn’t claim the NYT is the first to discover his identity, only that that are big enough to for that revelation to be pernicious.
- newen 6y ago
  Security by obscurity is a problem because a site can get destroyed if one person discovers the flaw. He cares mainly if a not insignificant number of his patient discover him.
- jccooper 6y ago
  Keeping one's name secret is not the same as restricting login access; it's more akin to restricting knowledge of your password. If you know a way to keep a password secret while also publishing it, let me know. Yes, it's fragile, and most people doing this don't have great opsec. But in general it works fine, as the threat model of someone looking you up on Facebook doesn't require a great deal to defeat. It's really rather unhelpful, however, when someone with high Google karma decides to publish that information you want kept secret.
- nullc 6y ago
  Obscurity as a primary security method is criticized when it exist as an alternative to being, you know, actually secure. Like, I could have RCE's in my software and hide the source to hopefully slow you from finding them. ... or I could fix the bugs! But for many things, being "actually secure" isn't cheap or even possible at all... and perhaps obscurity and other less strong tools are the best anyone can do.
- red_admiral 6y ago
  Security by obscurity is roundly discounted when there's an obvious way to do it right. For example, you store your passwords BASE64 encoded in the database, when you could be using scrypt. When there's not an obvious way to do it, you have to fall back on the chouices that you have. The choices for a psychiatrist seem to be not have a blog or online profile at all, or run one under a pseudonym.

mhb 6y ago

How is this different than a security through obscurity argument which is so roundly discounted by virtually everyone who reads HN?

someone7x 6y ago
Doesn’t he admit as much in the article? He doesn’t claim the NYT is the first to discover his identity, only that that are big enough to for that revelation to be pernicious.
newen 6y ago
Security by obscurity is a problem because a site can get destroyed if one person discovers the flaw. He cares mainly if a not insignificant number of his patient discover him.
jccooper 6y ago
Keeping one's name secret is not the same as restricting login access; it's more akin to restricting knowledge of your password. If you know a way to keep a password secret while also publishing it, let me know. Yes, it's fragile, and most people doing this don't have great opsec. But in general it works fine, as the threat model of someone looking you up on Facebook doesn't require a great deal to defeat. It's really rather unhelpful, however, when someone with high Google karma decides to publish that information you want kept secret.
nullc 6y ago
Obscurity as a primary security method is criticized when it exist as an alternative to being, you know, actually secure. Like, I could have RCE's in my software and hide the source to hopefully slow you from finding them. ... or I could fix the bugs! But for many things, being "actually secure" isn't cheap or even possible at all... and perhaps obscurity and other less strong tools are the best anyone can do.
red_admiral 6y ago
Security by obscurity is roundly discounted when there's an obvious way to do it right. For example, you store your passwords BASE64 encoded in the database, when you could be using scrypt. When there's not an obvious way to do it, you have to fall back on the chouices that you have. The choices for a psychiatrist seem to be not have a blog or online profile at all, or run one under a pseudonym.