This same website gets posted once in a while and it drives me crazy.
Do not use this service. With less than 60 seconds of looking, you can hijack people's deadmanswitch accounts with a simple CSRF on the email change API.
If you have a "high value secret" and you are a normal person, lawyers work pretty well. If you have a "high value secret" and you're Ed Snow, something like this site is not a solution you should use because it will get you killed. Nobody has a use for this...
Whoops, thanks for that, will fix. The service is pretty old, but I'm still surprised I didn't add the CSRF fix on one of the rewrites.
That said, tens of thousands of users apparently have a use for this. I'd imagine it's mostly "last goodbyes" type of stuff, also many users email me saying they want something to send "something happened to me, please come so my dog won't starve".
"Millionaire with assets" and "Ed Snowden" aren't the only two possibilities.
> No, it might surprise you to learn that all humans eventually die.
This seems uselessly snarky, especially since StavrosK (who I assume is the developer, based on other posts) gave a polite and snark-free response already:
> That's actually probably a good idea, I will add that, thanks.
How many emails have been triggered thus far with the service? And does it feel kind of weird seeing that data and knowing that you're pretty much being notified of people's deaths (at least if used as intended)?
The vast majority should be testing emails. I don't have data on it, but everyone who emails me is testing the service, so I expect very few actual deaths compared to the test emails every new user adds.
Wouldn't the dog have trouble waiting out the ~70 day delay? It seems pretty hard to make it timely but not overzealous. It seems like this would work better as a mobile app that can pick up more signals that life may have ceased.
Yea, I'd be more likely to write my own if I wanted such a thing. The trouble is you don't want e-mails going out prematurely .. which is why 90 day window is probably best.
And if you host that yourself, there's a chance your credit card could get canceled and your VM/docker container/whatever gets canceled and destroyed before it does its thing. ... but I mean who cares. No you. You're dead! :-P
Perhaps the author should serve a long and random token each time you go to the change email page, and require the API call to answer back with that token.
You have described CSRF tokens exactly =]. This is exactly what they should do, but this is necessary for ALL state changing requests not just the email change.
Right! I'm just pointing out that this isn't necessarily malice or negligence on the part of the author. Dead Man's Switch has some ways it could be improved, and remembering to set up a CSRF token seems to be one of them.
> It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users.
This is very true - but often the author does intend to take security seriously and they've simply overlooked something. The best approach in that scenario is just to talk to them and ask them to take a look at a vuln you've found, rather than immediately telling all their potential users to stay away.
I'm not some heartless security snob. This is not the first time I've seen this site, and it's been broken for at least a year (when I pointed this out last time). Because of that people SHOULD stay away.
Even if the authors of such services are highly knowledgable about security, they're going to rely on reports from hobbyist security researchers to fill in the gaps. There are major companies out there right now with dedicated infosec departments - and even they have bug bounty programs, because they know they can't catch everything.
I don't imagine this service gets an enormous amount of traffic. You might be among the handful of visitors to the site who are capable of noticing the CSRF issue, and maybe even the only one to go in and look at the source. He's had an email address up on his site for a while (hi@stochastictechnologies.com). Did you report the vuln to the author when you first found it?
That's all perfectly reasonable, and I'm not without sympathy for StavrosK on this.
I'm also not sanguine about the idea of using a service which is meant to handle information of such gravity as this, and which has also had an extremely well understood, trivially fixed, and enormously compromising information disclosure vulnerability go unfixed for a year or more. The reason why that situation has obtained is not interesting to me; that that situation has obtained is enormously so.
This one I agree with. I wouldn't use the service personally until the issue is fixed. But it is so counterproductive to find a security problem the average user wouldn't notice, and then not tell the author about it.
I wouldn't use the service even afterward. The dev didn't think about CSRF for a year. What else didn't he think about?
Don't get me wrong - I think very highly of what 'StavrosK is trying to do here, and I agree that it's counterproductive not to report an issue once found in a case like this. (There's a certain degree of nuance made necessary by the fact that kill-the-messenger reflexes make vulnerability reporting so fraught in general. But that doesn't seem likely to obtain in this case, so I'd report, probably not even anonymously.) But at this point that trust just isn't coming back.
I'm not going to do any more responding. The author of the service is an active HN user and has been for 5 years. I have no idea if I reported the issue by email or not...
Anyone who "cares" about security should know about CSRF. It is one of the 3 attacks that all web devs encounter. It's trivial to find.
The app is written in Django, probably all the way from 0.96. I rewrote it at some point, but I must have forgotten to add the CSRF middleware on an upgrade.
Do not use this service. With less than 60 seconds of looking, you can hijack people's deadmanswitch accounts with a simple CSRF on the email change API.
If you have a "high value secret" and you are a normal person, lawyers work pretty well. If you have a "high value secret" and you're Ed Snow, something like this site is not a solution you should use because it will get you killed. Nobody has a use for this...