Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dead Man's Switch

deadmansswitch.org

Post reply on HN
Print view View original

91–100 of 101 posts

Re: Dead Man's Switch

#91

Post by blueskin_ »

Houshalter wrote: post #78
logn wrote: post #77

Earlier quoted context omitted.

The whois record mentions a contact at http://www.digital-z.net/ which returns One... May you live in not too interesting dreams. Thank you and good night. ... which would indicate they're gone. And the deadmansswitch.org has a footer that points to http://binarymonkey.com which has a 2008 copyright date. In one year the app's domain will expire which could be unfortunate if anyone expected an actual dead man's switc…

The bottom of the site says copyright 2014.

That could just be using a date() -type function.

Re: Dead Man's Switch

#93

Post by baby »

bentcorner wrote: post #86
baby wrote: post #53

Earlier quoted context omitted.

> you're clicking on this thing every month That's a huge problem. You tell me I have to click on a link at least once a month for the rest of my life. First, I don't know if I'll have the same email for the rest of my life, if I change I'll have to think about changing that notification, that will have become spam in my mind. Second, There surely will be a month in my life where I won't check my mails. I can't think…

> That's a huge problem. You tell me I have to click on a link at least once a month for the rest of my life. shrug from the point of view of someone who has opted in, this isn't a big deal. People don't change email addresses that often, and if you're the type who doesn't check email for longer than a month, then yeah, this isn't for you. The bigger problem is that this service is hard to test. When you really want…

> from the point of view of someone who has opted in, this isn't a big dea

Maybe you're not familiar with that kind of thing. Give it time, it will become a hassle to your mind and you will opt out at some point if the service hasn't shut down yet.

> People don't change email addresses that often

Did you have the same email address 10 years ago? If so woah, I don't know a lot of people who do.

> if you're the type who doesn't check email for longer than a month

I said at one point in life. I can see myself taking the transiberian for example, travelling through Australia, etc... for a month in a big adventure without internet.

It's hard to predict what's going to happen in your life. Being sure that you'll have internet at least once a month for the rest of your life is a ... extraordinary prediction.

Re: Dead Man's Switch

#95

Post by GeneralMayhem »

benmanns wrote: post #55
steveklabnik wrote: post #37

Earlier quoted context omitted.

SSNs aren't unique, so this seems quite risky.

Wow! I had no idea. According to http://www.idanalytics.com/news-and-events/news-releases/201... > More than 15 percent of SSNs are associated with two or more people. More than 140,000 SSNs are associated with five or more people. Significantly, more than 27,000 SSNs are associated with 10 or more people.

That article is referring to corporate records, though, and leads with the fact that many people have multiple SSNs if you track all their commercial accounts as gospel truth. Does social security actually hand out duplicate SSNs, or is this all caused by people not remembering theirs/bad typing?

Re: Dead Man's Switch

#96

Post by jimktrains2 »

theboss wrote: post #74
jimktrains2 wrote: post #64

Earlier quoted context omitted.

I see this: Email: Password: Create an account Also, what does/can anyone do to prevent a MITM attack? Even if thy sent a HSTS header or a redirect, they're still subject to that.

That is the login form. I'm not sure how to paste code onto hacker news so here is a pastebin of the registration form. http://pastebin.com/Ctkw6S2h Well a better practice would be all HTTPS for the site. There are a lot of problems with this and I will probably write a blog post about it. Everything about this site misses every best practice. 1. No CSRF tokens 2. Small secret tokens to trigger the switch. 3. passwor…

/me is unable to read :( sorry abotu that

Yeah, it is. Especially since their cert is over a year dead.

Re: Dead Man's Switch

#97

Post by jarrett »

StavrosK wrote: post #48
jarrett wrote: post #43

Earlier quoted context omitted.

In any protocol, how would you manage the decryption keys? If the file's owner is dead, s/he can't provide the keys. So that means the keys must be transmitted to some trusted party before the owner's death. That party could be the dead man's switch service, but do you want to trust them? I wouldn't. (Nothing against the operators of this site. It's just inherently risky to trust a website operator in this type of si…

Yes, that's what PGP is for. Encrypt whatever you want to the recipient(s)' public keys, done.

I should have mentioned: I was assuming the recipients weren't necessarily PGP users. Realistically, most people aren't. I'd imagine a dead man's switch would often be used to send documents to law enforcement, lawyers, journalists, etc. How many of those people have PGP public keys? If they don't, then you have to ask them to create one. Besides the difficulty in getting people to adopt PGP, you're also back the problem of disclosing your dead man's switch prior to your death.

Re: Dead Man's Switch

#98

Post by jarrett »

kryptiskt wrote: post #89
jarrett wrote: post #43

Earlier quoted context omitted.

In any protocol, how would you manage the decryption keys? If the file's owner is dead, s/he can't provide the keys. So that means the keys must be transmitted to some trusted party before the owner's death. That party could be the dead man's switch service, but do you want to trust them? I wouldn't. (Nothing against the operators of this site. It's just inherently risky to trust a website operator in this type of si…

> So I'm wondering: Is there any way to do this a) with encryption, b) without entrusting the keys to the operator of the service, and c) without informing the recipients in advance? Give half the key to the service and half to your friends, then you're only vulnerable to a conspiracy between them. Or do some more elaborate m of n thing.

What about my third desire:

> c) without informing the recipients in advance

If you're willing to arrange the protocols with your recipients in advance, there are multiple viable approaches. But what if telling them in advance is itself a security risk?

Re: Dead Man's Switch

#99

Post by jarrett »

gingerlime wrote: post #47
jarrett wrote: post #43

Earlier quoted context omitted.

In any protocol, how would you manage the decryption keys? If the file's owner is dead, s/he can't provide the keys. So that means the keys must be transmitted to some trusted party before the owner's death. That party could be the dead man's switch service, but do you want to trust them? I wouldn't. (Nothing against the operators of this site. It's just inherently risky to trust a website operator in this type of si…

I wonder if you can split things between several switches. In the most simple scenario, DMS #1 would receive an encrypted file to be sent to Bob in case of Alice's death. DMS #2 would receive a passphrase for the encrypted file, also to be sent to Bob (or they can be sent to Ben, who would have to meet Bob and both of them together get access) DMS #1 and #2 (Assuming there are several 'providers' in the 'market') wou…

That's a good idea. I think you're right: An attacker would have to compromise all the DMSs to obtain the plaintext. That's not outside the realm of possibilities. But it is much harder than compromising just one. At that point, the DMSs might not be the weak link in the chain anymore--an attacker might find it easier to attack your own systems. (Which is a good thing.)

Re: Dead Man's Switch

#100

Post by jliptzin »

tormeh wrote: post #69
jliptzin wrote: post #46

Earlier quoted context omitted.

What prevents the bad guy from torturing you until you disable the DMS, then kill you?

Any good DMS of that calibre can't be disabled. The operator must take upfront payment and not care if you die or not, only fulfilling a contract you can't go back on. Sounds like something a Swiss bank could do for you, if stereotype is to be believed.

Well, that may be so, but try explaining that to a (probably) not so intelligent bad guy who will just continue torturing you. Maybe a good feature for a DMS system would be a fake shut off switch that appears to be convincing to an adversary.
Post reply on HN