Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: What happens if you disappear

cronu.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Show HN: What happens if you disappear

#41

Post by pomnia »

0xmohit wrote: post #37
runjake wrote: post #25

I can see so many things go wrong with this: - Company tanks. - Company gets acquired, and your private data gets mined. - Company gets hacked and database dump gets posted. I think I'd rather stick to the old methods of sealed envelopes and trusted friends or a lawyer. It's more reliable and requires less brain time slices ("Does the comapny still exist? Has it been hacked or acquired?" etc)

Another possibility is: - An insider misuses powers .

That shouldn't be possible, everything is encrypted with the OAuth provider ids that are not stored and available only through the login ... then again SSH was broken ...

Re: Show HN: What happens if you disappear

#42

Post by dvirsky »

runjake wrote: post #25

I can see so many things go wrong with this: - Company tanks. - Company gets acquired, and your private data gets mined. - Company gets hacked and database dump gets posted. I think I'd rather stick to the old methods of sealed envelopes and trusted friends or a lawyer. It's more reliable and requires less brain time slices ("Does the comapny still exist? Has it been hacked or acquired?" etc)

Or per a single user, even if all else works well:

- Email account gets hacked, and you can't respond to emails anymore.

- Spam filter bug filters the service's emails for 3 consecutive weeks.

- You are simply hospitalized for a few weeks, maybe under anesthesia, maybe in a temporary coma, maybe some memory loss.

A "dead man switch" needs to be more robust for really sensitive stuff IMO.

Re: Show HN: What happens if you disappear

#43

Post by pomnia »

LeifCarrotson wrote: post #30
pomnia wrote: post #18

Earlier quoted context omitted.

Yeah you are right. I think we are safe for now in the cloud wars ... maybe.

You are in the least safe position possible. You're on a free Google service. In spite of the longevity of a few of these services, those are shut down all the time . You say: > To make sure you are well and sound, Cronu will charge your card a dollar a month. I would insert "and to ensure your message remains available", as written this feels so inauthentic as to be mildly offensive. And then take that dollar a mont…

We do have budget and will be paying once quota is depleted (can't wait for that moment) but so far (and in case of our disappearance) free should sustain the minimum viable service levels (aka delete account).

Re: Show HN: What happens if you disappear

#44

Post by joshfraser »

pomnia wrote: post #41
0xmohit wrote: post #37

Earlier quoted context omitted.

Another possibility is: - An insider misuses powers .

That shouldn't be possible, everything is encrypted with the OAuth provider ids that are not stored and available only through the login ... then again SSH was broken ...

Then how are they going to decrypt the messages to send to your loved ones?

Re: Show HN: What happens if you disappear

#45

Post by codingdave »

pomnia wrote: post #41
0xmohit wrote: post #37

Earlier quoted context omitted.

Another possibility is: - An insider misuses powers .

That shouldn't be possible, everything is encrypted with the OAuth provider ids that are not stored and available only through the login ... then again SSH was broken ...

Dude...

People are raising valid concerns about your product, and instead of listening and accepting early feedback from HN, you are all over this discussion, defensively arguing with everyone. Just sit back, hear what people have to say, and then decide for yourself if you want to make changes, or reject the feedback.

Re: Show HN: What happens if you disappear

#46

Post by angry-hacker »

codingdave wrote: post #20
simonsarris wrote: post #15

Google already has a service for this: https://www.google.com/settings/u/0/account/inactive

Real life already has a service for this. They are called lawyers. They can keep your records on file, you know who they are, they have legal responsibility to keep everything confidential, and when you die... things just work. I guess this would work for more casual documents, passwords to facebook, whatever. I have a document printed out and kept in our file cabinet for such things, so I would not use this service,…

What about passwords and such? How do you handle it when it comes to will?

Re: Show HN: What happens if you disappear

#48

Post by angry-hacker »

antisthenes wrote: post #26

> If a subscription charge fails three consecutive weeks, Cronu will release your message. Oh boy. I can see so much going wrong with this.

You can easily be hospitalized, trap in another country without communication etc. etc. for three weeks.

Re: Show HN: What happens if you disappear

#49

Post by throwanem »

> The system can not generate the key required to decrypt your data unless you are logged in. Our staff have no means of accessing your data at any given time.

If this is true, how can your service work? If I'm dead, I can't log in to generate a decryption key so my message can be sent in the clear.

If your service works, how can this be true? If it can decrypt and send my message in the clear when I'm dead, I very evidently don't need to log in for decryption to occur.

Re: Show HN: What happens if you disappear

#50

Post by pomnia »

throwanem wrote: post #49

> The system can not generate the key required to decrypt your data unless you are logged in. Our staff have no means of accessing your data at any given time. If this is true, how can your service work? If I'm dead, I can't log in to generate a decryption key so my message can be sent in the clear. If your service works, how can this be true? If it can decrypt and send my message in the clear when I'm dead, I very e…

When you add recipient your message is (decrypted using your id) copied and the copy is encrypted with the recipient email. Once the recipient logs in (their OAuth id becomes available) the email (verified by the OAuth) is used to decrypt the message copy and encrypted again this time with his/her id. That temporary email encrypted message is decryptable of course although there is no utility or UI for us to do so. I guess we'd better store the owner Id and don't make copies, since it doesn't change anything security wise ... Yes, rogue admin can do harm ...
Post reply on HN