Little Man in My Head
littlemaninmyhead.wordpress.com · Personal blog · on HN since 2015
An anonymous-style blog by a former cryptographer on crypto mistakes, UUID security, bots, and why he left cryptography.
What HN saysHN links it for its warning that UUIDs should not be used as authentication tokens, and one commenter who worked with the author vouches for him.
28HN people shared it
2linked it in comments
31stories submitted
930story points
1 year agolast shared
2015people per year2026
Most-shared posts
- 1So, You Want to Learn to Break Ciphers5 people · 365 points · first shared 2015 · 26 comments on HN
- 2Top Developer Crypto Mistakes5 people · 19 points · first shared 2017 · 1 comments on HN
- 3UUIDs generally do not meet security requirements3 people · 138 points · first shared 2015 · 62 comments on HN
- 4How I Became a Cryptographer3 people · 6 points · first shared 2017 · discussion on HN
- 5Fighting Bots with the Client-Puzzle Protocol2 people · 16 points · first shared 2020 · 2 comments on HN
- 6If you copied these popular StackOverflow code snippets, then you coded it wrong2 people · 6 points · first shared 2021 · discussion on HN
- 7No, Java Is Not a Secure Programming Language2 people · 3 points · first shared 2021 · 1 comments on HN
- 8Why I Left Cryptography2 people · 2 points · first shared 2017 · discussion on HN
- 9Don’t underestimate grep-based code scanning1 people · 166 points · first shared 2019 · 117 comments on HN
- 10Inverting the Xorshift128 random number generator1 people · 110 points · first shared 2025 · 53 comments on HN
- 11Understanding Certificate Pinning1 people · 49 points · first shared 2020 · 24 comments on HN
- 12A Review of PentesterLab1 people · 41 points · first shared 2017 · 5 comments on HN
- 13Secure Coding: Understanding Input Validation1 people · 4 points · first shared 2018 · discussion on HN
- 14How I avoided management for 25 years1 people · 2 points · first shared 2023 · discussion on HN
- 15Protecting user accounts when usability matters1 people · 2 points · first shared 2019 · discussion on HN
What HN people wrote when they linked it
ciupicri · 2019-05-25
From https://littlemaninmyhead.wordpress.com/2015/11/22/cautionary-note-uui…
> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example.
HN discussion: https://news.ycombinator.com/item?id=10631806
zxcmx · 2017-11-03
This is the author: https://scholar.google.com.au/citations?user=9gs9StcAAAAJ&hl=en&am…
Not a shill. Source: worked with him.
This post of his is an interesting read and might give a bit more background to the what you saw: https://littlemaninmyhead.wordpress.com/2017/10/23/why-i-left-cryptogr…