7 ms·

Show HN: End-to-End Encrypted Dead Man's Switch

EnthusiastShiv 2y ago
Cipherwill is an automated and end-to-end encrypted digital will platform
silisili 2y ago
I feel like these services have a chicken egg dilemma. For example, I'm highly interested in it, but don't sign up because I don't know if they'll be around in a year or 10. So I'd like to see one long established before going all in, but it's hard for one to get long established without early users.
- EnthusiastShiv 2y ago
  I totally get that dilemma! It’s hard to commit without knowing if a service will be around long-term. Cipherwill is dedicated to the long haul and is also hosted on decentralized blockchain storage for added security and longevity.
  - silisili 2y ago
    Thanks for taking the time to reply. I'm definitely interested - I'll certainly be keeping an eye on it. It'd probably be nice to try to assuage uncertainty in the FAQ somewhere if not already as a long term vision/plans comes into focus.
    - EnthusiastShiv 2y ago
      We’ll definitely consider adding more to the FAQ to address any uncertainties as our long-term vision develops. Thanks for feedback.
  - 3np 2y ago
    > Cipherwill is dedicated to the long haul and is also hosted on decentralized blockchain storage for added security and longevity. Which blockchain? In what sense is it decentralized from perspective of CipherWill users?
mplewis 2y ago
Since your service is centralized, what is the sequence of events that leads to my digital data being disclosed without my consent/death? For example, if I am a beneficiary of Jane Doe, and I hack Cipherwill, can I get the keys I need to steal Jane Doe’s data while she is alive?
- EnthusiastShiv 2y ago
  Cipherwill’s encryption is designed so that even if someone hacks the platform, they can’t access anyone’s data. The encryption keys are split between the user and their beneficiaries, and no one — including us — can access the data without the owner’s consent or passing. So, even if you're a beneficiary, you can’t get Jane Doe’s data while she’s alive.
wutwutwat 2y ago
> Securely store crypto wallets, investments, bank details, emails, logins, and notes in Cipherwill. I don’t have any investments or crypto and, sorry, if I ever did I wouldn’t trust you with that info and give you the means to rob and/or steal my identity. That’s a bold ask with a closed source app. I built my own dead man’s switch, which lives in the open on GitHub. It’s a simple rails app w/ encrypted tables and some background jobs to send email checks and reset numbers, or blast out info if you’re not answering. I have no valuable info to put in it.
- EnthusiastShiv 2y ago
  Hey, I totally get your concerns — trust is crucial with personal data. It's awesome, you've built your own dead man's switch on GitHub! Our encryption means we can’t access your info — it’s yours and your beneficiaries’. But if your setup works for you, that’s great. Thanks for sharing!
  - mfalcao 2y ago
    Can you explain how the encryption works, who holds the keys, etc in detail? Your website seems to be very light on details.
    - EnthusiastShiv 2y ago
      you can check on https://www.cipherwill.com/how-it-works https://www.cipherwill.com/how-it-works just select "I understand how encryption works"
      - 3np 2y ago
        > you can check on https://www.cipherwill.com/how-it-works https://www.cipherwill.com/how-it-works just select "I understand how encryption works" This is very high-level and doesn't actually answer the question asked. I also don't see anything here regarding the decentralized blockchain storage you mentioned in another comment. How does that fit in here?
nixosbestos 2y ago
I'm not sure there's anything a service like this could do to assure me that (1) I can trust them, and (2) that they can actually make the UX of this meaningfully better, without compromising security fundamentally. For now, I'm rocking: * yubikeys pre-provisioned with keys given to select family members * sops to encrypt my "will" to those keys * sops-encrypted file hosted on google drive, pre-shared to select family members Luckily I have enough technical family and friends that they would eventually figure out how to run `sops decrypt`. And/or enough funds that they can hire someone if need be. Weakest part here is my BIP39 is not Shamir'd, so a rouge family member could empty my wallet. But I trust them. More than a third party presuming-for-profit service. :( Not to be a party-pooper, it's a neat idea. (edit, s/bip32/bip39/g)
- EnthusiastShiv 2y ago
  totally understand your concerns, especially with your solid setup using Yubikeys and sops. We're actually adding Yubikey support for end-to-end encryption too, focusing on good UX without sacrificing security. Plus, we're using homomorphic encryption, so your data stays secure while you're alive, so family members could not empty you're wallets. Appreciate your feedback!
  - 3np 2y ago
    Are you planning to release source code? Without at minimum client sources matching the builds, all assertions of trustlessness are pretty void. Doing under a free/open-source license would address some further concerns about long-term sustainability (which seems especially relevant here).
    - EnthusiastShiv 2y ago
      We’re exploring the possibility of releasing some source code, but we’re not sure how that will fit into our overall development strategy. Transparency and trust are important to us, and we’ll keep your suggestions in mind as we move forward.
- pjkundert 2y ago
neutrinoq 2y ago
A decentralized, open-source, subscription-free version of this: https://bitnote.xyz/ https://bitnote.xyz/
- EnthusiastShiv 2y ago
  That sounds interesting! While Cipherwill focuses on strong encryption, secure data handling, and a user-friendly experience. Thanks for sharing!
3np 2y ago
Where an how is user data stored? Do you use cloud providers/SaaS and in which jurisdiction? Considering legal requests for user data are being served, location/jurisdiction for both CipherWill and its servers are important and I don't seem to find this mentioned. Aside, but I don't think I'm alone in considering this a non-starter combined with the whole stack including the client being closed-source. Fresh advertising but still needs way more transparency (and a round of eyes on your ToS and Privacy Policy) to not look like a honeypot.
- EnthusiastShiv 2y ago
  We’re committed to transparency and are exploring ways to improve our documentation, including our Terms of Service and Privacy Policy. Your input is valuable, and we’ll take it into account as we develop the platform further.
  - 3np 2y ago
    You didn't address the main question: > Where an how is user data stored? Do you use cloud providers/SaaS and in which jurisdiction? Considering legal requests for user data are being served, location/jurisdiction for both CipherWill and its servers are important and I don't seem to find this mentioned.
    - EnthusiastShiv 2y ago
      All data is stored in the encrypted form in frankfurt as the cloud provider is from EU. We also use vercel to deliver client code.
leesalminen 2y ago
What happens if Cipherwill goes out of business before my death? The whole thing goes kaput and I’m stuck figuring out a new solution?
- EnthusiastShiv 2y ago
  If Cipherwill goes out of business, we'll make sure to share your data with you so you won't be stuck without a solution. Plus, Cipherwill's data is hosted on blockchain, which helps ensure we won't go out of service.
  - leesalminen 2y ago
    Which blockchain is user data stored on?
    - EnthusiastShiv 2y ago
      We'll be adding pages for live monitoring that display decentralized storage usage and access details very soon
201984 2y ago
From: https://www.cipherwill.com/how-it-works https://www.cipherwill.com/how-it-works > Each security factor is represented by a public/private key pair, which is used to encrypt your data on your device. So where are the private keys stored? AFAICT, this is just a web app and I know of no way to securely store a private key from one. Even if there is a desktop application and my private key is stored there, what happens if I lose my desktop? Am I locked out of my will permanently? > Cipherwill uses Homomorphic encryption to encrypt data pods again, creating a "time capsule" key. This key ensures that the data remains encrypted and inaccessible until a specified time. Is there anything preventing you from releasing these "time capsule" keys ahead of schedule other than good will? > Data pods are encrypted using 256 or 512 AES encryption 512 AES encryption? Seeing as AES only goes up to 256, you aren't exactly inspiring confidence here. > If you and your beneficiaries have security factors enabled, it is impossible for anyone, including Cipherwill, to access or decrypt your data. So it's end-to-end encrypted only if me and my beneficiaries all choose it to be? That is a very different claim from what's on your main page. Overall, this "how it works" page is too vague for my liking, and I wouldn't trust this website with my will.
- EnthusiastShiv 2y ago
  Thanks for your feedback! Here’s a quick response to your concerns: 1. Private Key Storage: Private keys are derived locally from your security factors when you set up them. 2. Time Capsule Keys: The release of "time capsule" keys is governed by strict protocols, ensuring they’re only accessible at the specified time. 3. AES Encryption: We use AES-256, not 512, will fix that typo. 4. End-to-End Encryption: yes, End-to-end encryption requires both you and your beneficiaries to enable security factors.
  - Daviey 2y ago
    Can you expand on "strict protocols" please?
    - EnthusiastShiv 2y ago
      "strict protocols" refer to our will execution schedule, which ensures that the keys are only accessible after the switch is triggered. Even if someone were to hack the system and access the keys before execution, only the designated beneficiaries would have the ability to decrypt the data.
Etheryte 2y ago
I mean, just a regular will can cover all of this for you. For real assets listed on the page such as real estate, investments, etc, a will is the only real way to sort those out actually (unless you want whatever the default proceeding is where you're from). If you're the inheritor of someone, you can't just go and transfer their bank contents to your own account. As for things such as files, pictures, etc, you can write a master password down in your will if it's that important, but not important enough to share ahead of time. Most people I know though just share their password with their husband/wife. This looks like a SaaS solution in search of a problem.
- EnthusiastShiv 2y ago
  I understand your point — traditional wills are essential for physical assets. However, Cipherwill specifically addresses the complexities of digital assets (crypto and other data) which aren't always covered by standard wills. It provides a secure way to manage online accounts and sensitive data. Thanks for sharing!
- thepuppet33r 2y ago
  I'm with you. The whole time I was reading the copy on the site, I kept thinking "What's wrong with a normal will and a lawyer?" Even crypto can be handled via a will if you're smart about it. I have a document that contains all of our subscriptions, our key information, contacts, last will, etc, that I update monthly, put on a thumb drive, and hide in a place my wife knows. I can't encrypt it because she isn't tech savvy enough, but physical obscurity is enough for me. I encrypt the copy on my PC. I also print out a copy and have it in our lockbox. In addition, we have a shared password manager with a Yubikey that she has access to for MFA, and she knows the password. If we both die at the same time, one of my close friends knows where all of this is and can provide to the lawyer handling our kids provenance. I don't have much crypto because I think it's by and large a scam market, but it's on a drive that is described in the document on the USB. At the end of the day, the things that are important to me are written down as physical copies. We print off photos and put them in photo books. My favorite music is on CDs. All that said, I see the real benefit in a service like this for the older generation like my in-laws. I've had multiple conversations with him about the passwords to all their online accounts and all their critical information, and all their passwords are just stored in his Google Chrome password manager. My MIL doesn't know the password to his Chrome account. If he dies first, she's going to have a helluva time getting access to everything. So if he could sign up to a service like this that we could trust, it would be immensely helpful.
dambi0 2y ago
What’s the scenario for a will that expires? Also, I can see the use of commutative encryption for the time capsule support but I’m not seeing where homomorphic encryption fits in.
- EnthusiastShiv 2y ago
  we'll notify your beneficiaries and ensure that your data is accessed by them. We employ homomorphic encryption in cases where beneficiaries choose to switch/update/upgrade existing factors without notifying data owner.
3np 2y ago
PSA: Looking over their replies to the comments here, benefit of doubt is vanished. I'd urge everyone to be very wary.
- EnthusiastShiv 2y ago
  understand the skepticism and will figure out concerns as we continue to improve
DougN7 2y ago
You’re in the fun phase of designing the tech, but that’s not where the problem lies. I don’t trust you at all. You can tell me about the system you’ve designed, but I only have your word that it really works that way. Trust is 90% of your problem, and the tech is only 10%. I can’t think of anything you could write that would change that. I guess I have to trust my bank with my safe deposit box, but there I see keys, sign in sheets, staff that I recognize that are watching each other enter the vault, etc. How will a website mimic that?
- EnthusiastShiv 2y ago
  I completely understand — building trust is key, and we’re working on adding transparency through decentralization and exploring open-sourcing to give users more control over their data.
  - DougN7 2y ago
    How will you prove the decentralization is real and not some BS written by a scammer? How will you prove your app matches the open source to someone that can’t compile it themselves?
    - EnthusiastShiv 2y ago
      honestly don't know yet but we will add way to verify it on chain for sure

Cipherwill is an automated and end-to-end encrypted digital will platform

I feel like these services have a chicken egg dilemma. For example, I'm highly interested in it, but don't sign up because I don't know if they'll be around in a year or 10. So I'd like to see one long established before going all in, but it's hard for one to get long established without early users.

EnthusiastShiv 2y ago
I totally get that dilemma! It’s hard to commit without knowing if a service will be around long-term. Cipherwill is dedicated to the long haul and is also hosted on decentralized blockchain storage for added security and longevity.
- silisili 2y ago
  Thanks for taking the time to reply. I'm definitely interested - I'll certainly be keeping an eye on it. It'd probably be nice to try to assuage uncertainty in the FAQ somewhere if not already as a long term vision/plans comes into focus.
  - EnthusiastShiv 2y ago
    We’ll definitely consider adding more to the FAQ to address any uncertainties as our long-term vision develops. Thanks for feedback.
- 3np 2y ago
  > Cipherwill is dedicated to the long haul and is also hosted on decentralized blockchain storage for added security and longevity. Which blockchain? In what sense is it decentralized from perspective of CipherWill users?

mplewis 2y ago

Since your service is centralized, what is the sequence of events that leads to my digital data being disclosed without my consent/death? For example, if I am a beneficiary of Jane Doe, and I hack Cipherwill, can I get the keys I need to steal Jane Doe’s data while she is alive?

EnthusiastShiv 2y ago
Cipherwill’s encryption is designed so that even if someone hacks the platform, they can’t access anyone’s data. The encryption keys are split between the user and their beneficiaries, and no one — including us — can access the data without the owner’s consent or passing. So, even if you're a beneficiary, you can’t get Jane Doe’s data while she’s alive.

wutwutwat 2y ago

> Securely store crypto wallets, investments, bank details, emails, logins, and notes in Cipherwill. I don’t have any investments or crypto and, sorry, if I ever did I wouldn’t trust you with that info and give you the means to rob and/or steal my identity. That’s a bold ask with a closed source app. I built my own dead man’s switch, which lives in the open on GitHub. It’s a simple rails app w/ encrypted tables and some background jobs to send email checks and reset numbers, or blast out info if you’re not answering. I have no valuable info to put in it.

EnthusiastShiv 2y ago
Hey, I totally get your concerns — trust is crucial with personal data. It's awesome, you've built your own dead man's switch on GitHub! Our encryption means we can’t access your info — it’s yours and your beneficiaries’. But if your setup works for you, that’s great. Thanks for sharing!
- mfalcao 2y ago
  Can you explain how the encryption works, who holds the keys, etc in detail? Your website seems to be very light on details.
  - EnthusiastShiv 2y ago
    you can check on https://www.cipherwill.com/how-it-works https://www.cipherwill.com/how-it-works just select "I understand how encryption works"
    - 3np 2y ago
      > you can check on https://www.cipherwill.com/how-it-works https://www.cipherwill.com/how-it-works just select "I understand how encryption works" This is very high-level and doesn't actually answer the question asked. I also don't see anything here regarding the decentralized blockchain storage you mentioned in another comment. How does that fit in here?

nixosbestos 2y ago

I'm not sure there's anything a service like this could do to assure me that (1) I can trust them, and (2) that they can actually make the UX of this meaningfully better, without compromising security fundamentally. For now, I'm rocking: * yubikeys pre-provisioned with keys given to select family members * sops to encrypt my "will" to those keys * sops-encrypted file hosted on google drive, pre-shared to select family members Luckily I have enough technical family and friends that they would eventually figure out how to run `sops decrypt`. And/or enough funds that they can hire someone if need be. Weakest part here is my BIP39 is not Shamir'd, so a rouge family member could empty my wallet. But I trust them. More than a third party presuming-for-profit service. :( Not to be a party-pooper, it's a neat idea. (edit, s/bip32/bip39/g)

EnthusiastShiv 2y ago
totally understand your concerns, especially with your solid setup using Yubikeys and sops. We're actually adding Yubikey support for end-to-end encryption too, focusing on good UX without sacrificing security. Plus, we're using homomorphic encryption, so your data stays secure while you're alive, so family members could not empty you're wallets. Appreciate your feedback!
- 3np 2y ago
  Are you planning to release source code? Without at minimum client sources matching the builds, all assertions of trustlessness are pretty void. Doing under a free/open-source license would address some further concerns about long-term sustainability (which seems especially relevant here).
  - EnthusiastShiv 2y ago
    We’re exploring the possibility of releasing some source code, but we’re not sure how that will fit into our overall development strategy. Transparency and trust are important to us, and we’ll keep your suggestions in mind as we move forward.
pjkundert 2y ago

neutrinoq 2y ago

A decentralized, open-source, subscription-free version of this: https://bitnote.xyz/ https://bitnote.xyz/

EnthusiastShiv 2y ago
That sounds interesting! While Cipherwill focuses on strong encryption, secure data handling, and a user-friendly experience. Thanks for sharing!

3np 2y ago

Where an how is user data stored? Do you use cloud providers/SaaS and in which jurisdiction? Considering legal requests for user data are being served, location/jurisdiction for both CipherWill and its servers are important and I don't seem to find this mentioned. Aside, but I don't think I'm alone in considering this a non-starter combined with the whole stack including the client being closed-source. Fresh advertising but still needs way more transparency (and a round of eyes on your ToS and Privacy Policy) to not look like a honeypot.

EnthusiastShiv 2y ago
We’re committed to transparency and are exploring ways to improve our documentation, including our Terms of Service and Privacy Policy. Your input is valuable, and we’ll take it into account as we develop the platform further.
- 3np 2y ago
  You didn't address the main question: > Where an how is user data stored? Do you use cloud providers/SaaS and in which jurisdiction? Considering legal requests for user data are being served, location/jurisdiction for both CipherWill and its servers are important and I don't seem to find this mentioned.
  - EnthusiastShiv 2y ago
    All data is stored in the encrypted form in frankfurt as the cloud provider is from EU. We also use vercel to deliver client code.

leesalminen 2y ago

What happens if Cipherwill goes out of business before my death? The whole thing goes kaput and I’m stuck figuring out a new solution?

EnthusiastShiv 2y ago
If Cipherwill goes out of business, we'll make sure to share your data with you so you won't be stuck without a solution. Plus, Cipherwill's data is hosted on blockchain, which helps ensure we won't go out of service.
- leesalminen 2y ago
  Which blockchain is user data stored on?
  - EnthusiastShiv 2y ago
    We'll be adding pages for live monitoring that display decentralized storage usage and access details very soon

201984 2y ago

From: https://www.cipherwill.com/how-it-works https://www.cipherwill.com/how-it-works > Each security factor is represented by a public/private key pair, which is used to encrypt your data on your device. So where are the private keys stored? AFAICT, this is just a web app and I know of no way to securely store a private key from one. Even if there is a desktop application and my private key is stored there, what happens if I lose my desktop? Am I locked out of my will permanently? > Cipherwill uses Homomorphic encryption to encrypt data pods again, creating a "time capsule" key. This key ensures that the data remains encrypted and inaccessible until a specified time. Is there anything preventing you from releasing these "time capsule" keys ahead of schedule other than good will? > Data pods are encrypted using 256 or 512 AES encryption 512 AES encryption? Seeing as AES only goes up to 256, you aren't exactly inspiring confidence here. > If you and your beneficiaries have security factors enabled, it is impossible for anyone, including Cipherwill, to access or decrypt your data. So it's end-to-end encrypted only if me and my beneficiaries all choose it to be? That is a very different claim from what's on your main page. Overall, this "how it works" page is too vague for my liking, and I wouldn't trust this website with my will.

EnthusiastShiv 2y ago
Thanks for your feedback! Here’s a quick response to your concerns: 1. Private Key Storage: Private keys are derived locally from your security factors when you set up them. 2. Time Capsule Keys: The release of "time capsule" keys is governed by strict protocols, ensuring they’re only accessible at the specified time. 3. AES Encryption: We use AES-256, not 512, will fix that typo. 4. End-to-End Encryption: yes, End-to-end encryption requires both you and your beneficiaries to enable security factors.
- Daviey 2y ago
  Can you expand on "strict protocols" please?
  - EnthusiastShiv 2y ago
    "strict protocols" refer to our will execution schedule, which ensures that the keys are only accessible after the switch is triggered. Even if someone were to hack the system and access the keys before execution, only the designated beneficiaries would have the ability to decrypt the data.

Etheryte 2y ago

I mean, just a regular will can cover all of this for you. For real assets listed on the page such as real estate, investments, etc, a will is the only real way to sort those out actually (unless you want whatever the default proceeding is where you're from). If you're the inheritor of someone, you can't just go and transfer their bank contents to your own account. As for things such as files, pictures, etc, you can write a master password down in your will if it's that important, but not important enough to share ahead of time. Most people I know though just share their password with their husband/wife. This looks like a SaaS solution in search of a problem.

EnthusiastShiv 2y ago
I understand your point — traditional wills are essential for physical assets. However, Cipherwill specifically addresses the complexities of digital assets (crypto and other data) which aren't always covered by standard wills. It provides a secure way to manage online accounts and sensitive data. Thanks for sharing!
thepuppet33r 2y ago
I'm with you. The whole time I was reading the copy on the site, I kept thinking "What's wrong with a normal will and a lawyer?" Even crypto can be handled via a will if you're smart about it. I have a document that contains all of our subscriptions, our key information, contacts, last will, etc, that I update monthly, put on a thumb drive, and hide in a place my wife knows. I can't encrypt it because she isn't tech savvy enough, but physical obscurity is enough for me. I encrypt the copy on my PC. I also print out a copy and have it in our lockbox. In addition, we have a shared password manager with a Yubikey that she has access to for MFA, and she knows the password. If we both die at the same time, one of my close friends knows where all of this is and can provide to the lawyer handling our kids provenance. I don't have much crypto because I think it's by and large a scam market, but it's on a drive that is described in the document on the USB. At the end of the day, the things that are important to me are written down as physical copies. We print off photos and put them in photo books. My favorite music is on CDs. All that said, I see the real benefit in a service like this for the older generation like my in-laws. I've had multiple conversations with him about the passwords to all their online accounts and all their critical information, and all their passwords are just stored in his Google Chrome password manager. My MIL doesn't know the password to his Chrome account. If he dies first, she's going to have a helluva time getting access to everything. So if he could sign up to a service like this that we could trust, it would be immensely helpful.

dambi0 2y ago

What’s the scenario for a will that expires? Also, I can see the use of commutative encryption for the time capsule support but I’m not seeing where homomorphic encryption fits in.

EnthusiastShiv 2y ago
we'll notify your beneficiaries and ensure that your data is accessed by them. We employ homomorphic encryption in cases where beneficiaries choose to switch/update/upgrade existing factors without notifying data owner.

3np 2y ago

PSA: Looking over their replies to the comments here, benefit of doubt is vanished. I'd urge everyone to be very wary.

EnthusiastShiv 2y ago
understand the skepticism and will figure out concerns as we continue to improve

DougN7 2y ago

You’re in the fun phase of designing the tech, but that’s not where the problem lies. I don’t trust you at all. You can tell me about the system you’ve designed, but I only have your word that it really works that way. Trust is 90% of your problem, and the tech is only 10%. I can’t think of anything you could write that would change that. I guess I have to trust my bank with my safe deposit box, but there I see keys, sign in sheets, staff that I recognize that are watching each other enter the vault, etc. How will a website mimic that?

EnthusiastShiv 2y ago
I completely understand — building trust is key, and we’re working on adding transparency through decentralization and exploring open-sourcing to give users more control over their data.
- DougN7 2y ago
  How will you prove the decentralization is real and not some BS written by a scammer? How will you prove your app matches the open source to someone that can’t compile it themselves?
  - EnthusiastShiv 2y ago
    honestly don't know yet but we will add way to verify it on chain for sure