3 ms·

> Crack me if you can This reminds me of LifeLock CEO's Todd Davis public challenge [1] when he revealed his Social Security number prominently on his site and

> Crack me if you can This reminds me of LifeLock CEO's Todd Davis public challenge [1] when he revealed his Social Security number prominently on his site and billboards with overconfidence that his identity cannot be stolen but, unfortunately, he's been a victim of identity theft at least 13 times. 1. https://www.wired.com/2010/05/lifelock-identity-theft/ https://www.wired.com/2010/05/lifelock-identity-theft/

nashashmi 4y ago
He also ended up leaving the company after it was learned he was guilty of a previous felony for identity fraud.
- stickfigure 4y ago
  Do you have a reference for this? The internet doesn't seem to know anything about it. I suspect it is false.
  - nashashmi 4y ago
    https://www.phoenixnewtimes.com/news/lifelock-former-exec-and-founder-robert-maynard-jr-surfaces-in-hawaii-adventure-biz-6659115 https://www.phoenixnewtimes.com/news/lifelock-former-exec-an... Apparently it was the other cofounder. I confused the two.
mprime1 4y ago
I'm not that confident in my tool. That said, I ask myself every day if having my public identity associated to my project, website, etc. Was a good idea. It certainly helped with jobs in the past, but it's scary to hear stories of devs impersonated by others.
- redbell 4y ago
  > Portable Secret is not a product and it is barely a project You are such a humble person as you clearly stated why this thing was built. I am, in no way, claiming that you are too confident in your work, despite it being a cool project that can be used by privacy-aware techies. Your expression Crack me if you can just triggered LifeLock's story from the deepest part of my mind.
- cryptonector 4y ago
  Your tool would be safer if you used CBC (with some MAC) rather than GCM as the cipher mode, so that key & IV reuse would not be as dangerous. That said, since you generate a different salt and IV every time, the likelihood of key & IV reuse is very low, and having to implement an AEAD cipher mode by generic construction would be somewhat annoying. So I think the choice of GCM is fine enough.
  - mprime1 4y ago
    I started with CBC (without MAC) and upgraded with GCM since it was a more convenient way to provide integrity without adding the MAC step manually. I should really make sure IV/Salt are regenerated automatically after use. (there is a small print warning in the creator about reuse)
    - cryptonector 4y ago
      > I should really make sure IV/Salt are regenerated automatically after use. Good idea. > I started with CBC (without MAC) Oof, you really didn't want to do that :) Glad you upgraded to GCM.

nashashmi 4y ago

He also ended up leaving the company after it was learned he was guilty of a previous felony for identity fraud.

stickfigure 4y ago
Do you have a reference for this? The internet doesn't seem to know anything about it. I suspect it is false.
- nashashmi 4y ago
  https://www.phoenixnewtimes.com/news/lifelock-former-exec-and-founder-robert-maynard-jr-surfaces-in-hawaii-adventure-biz-6659115 https://www.phoenixnewtimes.com/news/lifelock-former-exec-an... Apparently it was the other cofounder. I confused the two.

mprime1 4y ago

I'm not that confident in my tool. That said, I ask myself every day if having my public identity associated to my project, website, etc. Was a good idea. It certainly helped with jobs in the past, but it's scary to hear stories of devs impersonated by others.

redbell 4y ago
> Portable Secret is not a product and it is barely a project You are such a humble person as you clearly stated why this thing was built. I am, in no way, claiming that you are too confident in your work, despite it being a cool project that can be used by privacy-aware techies. Your expression Crack me if you can just triggered LifeLock's story from the deepest part of my mind.
cryptonector 4y ago
Your tool would be safer if you used CBC (with some MAC) rather than GCM as the cipher mode, so that key & IV reuse would not be as dangerous. That said, since you generate a different salt and IV every time, the likelihood of key & IV reuse is very low, and having to implement an AEAD cipher mode by generic construction would be somewhat annoying. So I think the choice of GCM is fine enough.
- mprime1 4y ago
  I started with CBC (without MAC) and upgraded with GCM since it was a more convenient way to provide integrity without adding the MAC step manually. I should really make sure IV/Salt are regenerated automatically after use. (there is a small print warning in the creator about reuse)
  - cryptonector 4y ago
    > I should really make sure IV/Salt are regenerated automatically after use. Good idea. > I started with CBC (without MAC) Oof, you really didn't want to do that :) Glad you upgraded to GCM.