Hector Martin

Keeping there names a secret is not the point. Its against it actually. It just about getting some time to find others, without dropping a plaintext Google spreadsheet.

I know. And I'm saying that won't work after someone writes a Twitter bot to reverse the hashes in seconds for the lulz, turning the approach into the equivalent of a plaintext Google spreadsheet.

Oh wow, public records that are meant to be accessible for other interested people are not fully secure? Who in the sec community would see that coming?!

I dunno, ask the OP, she seems to think it's not a problem and not worth discussing, considering, or making clear to those using this scheme.

So you just assume that a bunch of women in the security industry have no idea what they are doing, while its quite obvious, and you can't understand why they are not interested in you explaining obvious stuff to them? Should I further explain why?

I conclude that *one* woman (who is a biologist) is clearly not aware of the tradeoffs in the design of this purported hash-based protocol and also doesn't seem to be interested in discussing it before blindly giving advice to others.

Have you checked how many brilliant men stepped up to inform her of that, or did you not bother? I'd love to see you guys being so active targeting predators as you are paternalising their victims.

Half of those "brilliant" men were conflating concepts like rainbow tables that are tangential and not offering any practical advice on how to improve the protocol or how to evaluate it. I tried to do the latter.