I've been working on something since 2022. Not constantly. Not with a plan. Just a thought that wouldn't leave me alone.
It started after my email got hacked. That day of locks I wrote about — there was an earlier version of that problem, quieter, before I knew what to look for. I found out my email password and my database password were the same one. I remember sitting there thinking, right. So that's all it takes.
And then I couldn't stop asking a question. What if the hash changed every time I logged in? What if the thing that proved who I was couldn't be reset by any company, but only by something I kept? Not a phone. Not an app. Something I lived.
I called it ID.me.
Three things to log in: a username, a password, and a secret number. That number does two things at once. It confirms identity and it picks one of 1,024 algorithms used to scramble the password. That selection isn't stored anywhere. It's worked out fresh each time, from what's in my head. Every successful login, the hash rotates. New salt, new hash, old one gone. A database snapshot from five minutes ago is already wrong for my account.
Recovery doesn't touch a phone. No SMS, no SIM swap attacks. A 16-word seed phrase from registration, and words from a personal story I wrote. Something that can't be intercepted because it was never transmitted.
I built a transparency panel into it so I can watch in real time what's actually sitting in the database. Everything encrypted or hashed. I can't read it by looking directly. Nobody can.
I have to be honest about something. I'm not a security professional. I'm someone with two jobs and a room that's fifteen square metres, building this in the gaps between everything else. The gaps are not large. The room confirms this daily.
Eleven days between the breach and this entry. The job didn't stop. The clients didn't stop. Life doesn't hold while I sort myself out. This got built in the edges of everything else.
Some things might not be perfect yet. I haven't broken every path through it. I know that. But the logic of a rotating hash, of a secret that selects the algorithm and never touches the server as a readable value, of recovery built on something lived rather than something a company holds on my behalf, I think that holds up. I think it's worth looking at.
So it's out. Not polished. Not finished. But working.
If it breaks, I want to find out. If something's missing, I want to find that out too. If the concept is solid but the execution needs work, that's the most useful thing I could learn right now. I'm not putting this out as a finished product. I'm putting it out because the only way to know if an idea holds up is to let it meet the world.
One person. One room. One idea that started with a hacked email in 2022 and ended up as a working prototype with a live database and a transparency panel.
Still building. Not done. Never will be.