The links
The private link that gets you back into a page you made, and the personal link that lets you change your own response, are each 256 bits of randomness. We store a fingerprint of them rather than the link, so somebody who took a copy of our whole database still could not open one. Fingerprints are compared in a way that takes the same time whether or not they match, so the comparison itself gives nothing away.
A link never goes in a query string, which is how one would otherwise leak through the header a browser sends as you click onwards. Those pages also ask browsers to send no referrer at all. A wrong link gets exactly the same "we can't find that" as a link to something that was never there, since anything else would let somebody map out what exists by guessing.
A link people share is 10 random characters, picked from an alphabet with no vowels in it so it cannot spell anything. Shared pages ask search engines not to index them.
Accounts and sessions
There are no passwords here, so there's nothing of that kind to steal. You sign in with a link we email you: it lasts 15 minutes and works once.
Your session is another 256-bit secret, kept in a cookie no script is allowed to read and stored as a fingerprint. It's replaced every time you sign in and lasts 90 days of use. "Sign out everywhere" ends all of them at once.
Anything that changes something, from a signed-in page, carries a token tied to your own session, so another site cannot make your browser do it behind your back.
The pages themselves
- Everything is served over HTTPS, and browsers are told to refuse anything else for a year at a time.
- A strict content policy means a page can only load things from us. Two pages widen it by exactly one origin each: the "are you a person" check when you make something, and the payment window on the billing page.
- Nothing a person types is ever treated as markup. Escaping on the way out is the default, not something a page has to remember to do.
- Every field is checked against a schema before it reaches the database, and every query binds its values rather than pasting them into a string.
- Nobody can put one of these pages inside a frame, which rules out clickjacking.
What we write down
Our logs hold no links, no email addresses and no names. Anything that might carry one goes through a scrubber before it's written down or sent anywhere, including to the service that tells us when something has broken. IP addresses are scrambled using a secret that replaces itself every 30 days.
Keeping the lid on
Making pages, responding to them, asking for a sign-in link and reporting a page all carry an hourly limit per machine. New pages get scanned for the patterns a scam page tends to have, and anything that matches waits for a person to look at it before it goes out.
Anybody can report a page from its footer. 3 different people reporting the same one pauses it automatically.
What our security rests on
No passwords to lose, no card numbers to lose, a short dependency list checked weekly, and a codebase where the riskiest parts carry the most tests. Every claim on this page can be checked against how the thing actually behaves, which is the kind of assurance we think is worth having.
If your organization needs a particular certification or an independent test before it can use this, write to us and we'll tell you right away where we stand on it — an honest answer rather than a sales pitch.
Telling us about a hole
Write to support@whenabouts.me with the subject "security". Tell us what you found and how to see it for ourselves.
What we promise in return:
- A reply within three working days, from a person rather than a form.
- We'll tell you what we're doing about it, and again when it's fixed.
- We will not take legal action against you for finding it in good faith. Good faith means not digging further than you need to, leaving other people's data alone, and giving us a chance to fix it before you tell the world.
- Credit by name, if you want it. There's no money here for a bounty, and we're not going to pretend otherwise.