5 ms·

This same website gets posted once in a while and it drives me crazy. Do not use this service. With less than 60 seconds of looking, you can hijack people's de

by ejcx 10y ago

This same website gets posted once in a while and it drives me crazy. Do not use this service. With less than 60 seconds of looking, you can hijack people's deadmanswitch accounts with a simple CSRF on the email change API. If you have a "high value secret" and you are a normal person, lawyers work pretty well. If you have a "high value secret" and you're Ed Snow, something like this site is not a solution you should use because it will get you killed. Nobody has a use for this...

djsumdog 10y ago
Yea, I'd be more likely to write my own if I wanted such a thing. The trouble is you don't want e-mails going out prematurely .. which is why 90 day window is probably best. And if you host that yourself, there's a chance your credit card could get canceled and your VM/docker container/whatever gets canceled and destroyed before it does its thing. ... but I mean who cares. No you. You're dead! :-P
- haddr 10y ago
  HAha, that what I wanted to ask: how do you check that system in production :)
  - throwaway456965 10y ago
    Same way you would host anything else potentially unwanted by authorities. You pay for it ahead of time in bitcoin and build redundancy.
etjossem 10y ago
Perhaps the author should serve a long and random token each time you go to the change email page, and require the API call to answer back with that token.
- ejcx 10y ago
  You have described CSRF tokens exactly =]. This is exactly what they should do, but this is necessary for ALL state changing requests not just the email change.
  - etjossem 10y ago
    Right! I'm just pointing out that this isn't necessarily malice or negligence on the part of the author. Dead Man's Switch has some ways it could be improved, and remembering to set up a CSRF token seems to be one of them.
    - StavrosK 10y ago
      The app is written in Django, probably all the way from 0.96. I rewrote it at some point, but I must have forgotten to add the CSRF middleware on an upgrade.
      - etjossem 10y ago
        Wonderful, thanks for giving it a second (third?) look.
    - ejcx 10y ago
      I don't think I'm being pedantic when I expect security software, or software dealing with secrets, to be secure. It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users.
      - etjossem 10y ago
        > It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users. This is very true - but often the author does intend to take security seriously and they've simply overlooked something. The best approach in that scenario is just to talk to them and ask them to take a look at a vuln you've found, rather than immediately telling all their potential users to stay away.
StavrosK 10y ago
Whoops, thanks for that, will fix. The service is pretty old, but I'm still surprised I didn't add the CSRF fix on one of the rewrites. That said, tens of thousands of users apparently have a use for this. I'd imagine it's mostly "last goodbyes" type of stuff, also many users email me saying they want something to send "something happened to me, please come so my dog won't starve". "Millionaire with assets" and "Ed Snowden" aren't the only two possibilities.
- eternalban 10y ago
  > "last goodbyes" ... "Millionaire with assets" and "Ed Snowden" aren't the only two possibilities. Suicidal tendencies, then? While you are applying the "fix" may want to add a link to suicide prevention resources.
  - StavrosK 10y ago
    That's actually probably a good idea, I will add that, thanks. EDIT: Added!
    - eternalban 10y ago
      Thank you! I'll delete my OP. [edit: well aparently can't anymore].
  - hueving 10y ago
    >Suicidal tendencies, then? No, it might surprise you to learn that all humans eventually die. Some of them even have families they want to send 'death-bed' notes to.
    - JadeNB 10y ago
      > No, it might surprise you to learn that all humans eventually die. This seems uselessly snarky, especially since StavrosK (who I assume is the developer, based on other posts) gave a polite and snark-free response already: > That's actually probably a good idea, I will add that, thanks. (https://news.ycombinator.com/item?id=12630400 https://news.ycombinator.com/item?id=12630400).
deleted 10y ago
[deleted]

by ejcx 10y ago

djsumdog 10y ago

Yea, I'd be more likely to write my own if I wanted such a thing. The trouble is you don't want e-mails going out prematurely .. which is why 90 day window is probably best. And if you host that yourself, there's a chance your credit card could get canceled and your VM/docker container/whatever gets canceled and destroyed before it does its thing. ... but I mean who cares. No you. You're dead! :-P

haddr 10y ago
HAha, that what I wanted to ask: how do you check that system in production :)
- throwaway456965 10y ago
  Same way you would host anything else potentially unwanted by authorities. You pay for it ahead of time in bitcoin and build redundancy.

etjossem 10y ago

Perhaps the author should serve a long and random token each time you go to the change email page, and require the API call to answer back with that token.

ejcx 10y ago
You have described CSRF tokens exactly =]. This is exactly what they should do, but this is necessary for ALL state changing requests not just the email change.
- etjossem 10y ago
  Right! I'm just pointing out that this isn't necessarily malice or negligence on the part of the author. Dead Man's Switch has some ways it could be improved, and remembering to set up a CSRF token seems to be one of them.
  - StavrosK 10y ago
    The app is written in Django, probably all the way from 0.96. I rewrote it at some point, but I must have forgotten to add the CSRF middleware on an upgrade.
    - etjossem 10y ago
      Wonderful, thanks for giving it a second (third?) look.
  - ejcx 10y ago
    I don't think I'm being pedantic when I expect security software, or software dealing with secrets, to be secure. It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users.
    - etjossem 10y ago
      > It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users. This is very true - but often the author does intend to take security seriously and they've simply overlooked something. The best approach in that scenario is just to talk to them and ask them to take a look at a vuln you've found, rather than immediately telling all their potential users to stay away.

StavrosK 10y ago

Whoops, thanks for that, will fix. The service is pretty old, but I'm still surprised I didn't add the CSRF fix on one of the rewrites. That said, tens of thousands of users apparently have a use for this. I'd imagine it's mostly "last goodbyes" type of stuff, also many users email me saying they want something to send "something happened to me, please come so my dog won't starve". "Millionaire with assets" and "Ed Snowden" aren't the only two possibilities.

eternalban 10y ago
> "last goodbyes" ... "Millionaire with assets" and "Ed Snowden" aren't the only two possibilities. Suicidal tendencies, then? While you are applying the "fix" may want to add a link to suicide prevention resources.
- StavrosK 10y ago
  That's actually probably a good idea, I will add that, thanks. EDIT: Added!
  - eternalban 10y ago
    Thank you! I'll delete my OP. [edit: well aparently can't anymore].
- hueving 10y ago
  >Suicidal tendencies, then? No, it might surprise you to learn that all humans eventually die. Some of them even have families they want to send 'death-bed' notes to.
  - JadeNB 10y ago
    > No, it might surprise you to learn that all humans eventually die. This seems uselessly snarky, especially since StavrosK (who I assume is the developer, based on other posts) gave a polite and snark-free response already: > That's actually probably a good idea, I will add that, thanks. (https://news.ycombinator.com/item?id=12630400 https://news.ycombinator.com/item?id=12630400).

deleted 10y ago

[deleted]