Middle school: SMS. I changed phone numbers often, and that’s how I noticed something odd. SMS verification was everywhere and everyone wanted it, yet it was inconvenient and fragile. Numbers get recycled, and codes can end up with whoever holds the number next. It never made sense to me that the weakest link was treated as the gold standard.
High school: Google. I stopped trusting big platforms with my data. I uninstalled Google apps, used only open-source alternatives, skipped carrier contracts for prepaid SIMs, and avoided LINE (Japan’s dominant messaging app). Even a tiny bit of my info showing up on Google scared me.
Age 20: The leak. Some online troll groups had a feud with each other, and I got caught in the middle just for being a mutual follower of one of the people involved. They sent threats through my contact form: bring that person to our board, or you and your friends get doxxed too. My home address was posted on someone else’s forum.
Honestly? Part of me found it exciting. Nothing actually happened. I refused their demands, replied once, and that was the end of it.
That’s when it clicked. An address or a face is just a meaningless string until someone decides to target you. People walk around in public with their faces showing every day, and nobody goes after them. The difference isn’t exposure. It’s whether someone has a motive. The danger was never the information itself.
Looking back on all those years of hiding, I realized two things:
You can’t hide completely. The moment you step outside, your face is visible. Every service pushes SMS verification and terms of service that assume you’ll hand over your data.
Hiding fails silently. “My info hasn’t leaked” and “my info leaked and I never noticed” look exactly the same from the inside. You can’t detect a leak you don’t know happened.
So I changed my approach. Instead of only hiding, I design for the leak: make leaked data useless, and make leaks detectable. Security folks call this “assume breach.”
I put that idea into a PHP session library. I’m not saying “never use cookies.” I’m saying hiding alone has limits.
The server stores only a hash of the user’s secret, so a stolen session store doesn’t let anyone in.
If session generations don’t match, the whole session is destroyed. Theft gets detected the moment the stolen session is used.
Secret values show up masked even through echo or var_dump, so they don’t slip into logs by accident.
https://github.com/PusyuuWanko/pusyuu_session
(The README is in Japanese for now.)
It took me the long way around, but here’s where I landed: spend less time hiding, and more time thinking about what happens when it leaks.
