The links
The private link that gets you back into a page you made, and the personal link that lets you change your own response, are each 256 bits of randomness. We store a fingerprint of them rather than the link, so somebody who took a copy of our whole database still could not open one. Fingerprints are compared in a way that takes the same time whether or not they match, so the comparison itself gives nothing away.
A link never goes in a query string, which is how one would otherwise leak through the header a browser sends as you click onwards. Those pages also ask browsers to send no referrer at all. A wrong link gets exactly the same "we can't find that" as a link to something that was never there, since anything else would let somebody map out what exists by guessing.
A link people share is 10 random characters, picked from an alphabet with no vowels in it so it cannot spell anything. Shared pages ask search engines not to index them.
Accounts and sessions
You can always sign in with a link we email you: it lasts 15 minutes and works once. You can also add faster ways in, and each is kept so that a copy of our database is not enough to use it:
- A password is at least 12 characters and is stored only as a slow scrypt hash, taken over a keyed signature of it, so guessing needs a secret that isn't in the database. Password sign-in pauses after 10 tries at one address, or 30 from one connection, in 15 minutes, and the emailed link keeps working.
- Two-step verification asks for a code from an authenticator app after a password or an emailed link. Its secret is stored encrypted, and its 10 backup codes as fingerprints, each good once.
- Google and Discord are recognized by the provider's own permanent id, stored as a fingerprint. An address they show counts only when the provider vouches for it. Google vouches only for a Gmail address or one at a Google Workspace account's own domain, so we confirm any other address it shows by email the first time.
- A passkey's private half stays with you and never reaches us. We store only the public half, which can check a signature but never make one, and every sign-in signs a fresh one-time challenge after your fingerprint, face or screen lock is checked.
Every change to how you sign in is emailed to you, so you hear about one you didn't make. Changing or removing a password needs the current one. Changing or removing a password, turning two-step on or off, or removing an outside account or a passkey also signs out every other device.
Your session is another 256-bit secret, kept in a cookie no script is allowed to read and stored as a fingerprint. It's replaced every time you sign in and lasts 90 days of use. "Sign out everywhere" ends all of them at once.
Anything that changes something, from a signed-in page, carries a token tied to your own session, so another site cannot make your browser do it behind your back.
The pages themselves
- Everything is served over HTTPS, and browsers are told to refuse anything else for a year at a time.
- A strict content policy means a page can only load things from us. Two pages widen it by exactly one origin each: the "are you a person" check when you make something, and the payment window on the billing page.
- Nothing a person types is ever treated as markup. Escaping on the way out is the default, not something a page has to remember to do.
- Every field is checked against a schema before it reaches the database, and every query binds its values rather than pasting them into a string.
- Nobody can put one of these pages inside a frame, which rules out clickjacking.
What we write down
Our logs hold no links, no email addresses and no names. Anything that might carry one goes through a scrubber before it's written down or sent anywhere, including to the service that tells us when something has broken. IP addresses are scrambled with a random value we replace every 30 days and delete within two months.
Limits and abuse checks
Making pages, responding to them, asking for a sign-in link and reporting a page all carry an hourly limit per machine. New pages get scanned for the patterns a scam page tends to have, and anything that matches waits for a person to look at it before it goes out.
Anybody can report a page from its footer. 3 different people reporting the same one pauses it automatically.
What our security rests on
Nothing in our database signs anybody in on its own: links and sessions are kept as fingerprints, passwords as slow keyed hashes and passkeys as their public halves. There are no card numbers to lose, the dependency list is short and checked weekly, and the riskiest parts of the code carry the most tests. Every claim on this page can be checked against how the thing actually behaves.
If your organization needs a particular certification or an independent test before it can use this, write to us and we'll tell you right away where we stand on it.
Reviewing us for a school or an organization? The security summary puts this on one page, with the data-processing addendum and the accessibility report beside it.
Reporting a security problem
Write to support@whenabouts.me with the subject "security". Tell us what you found and how to see it for ourselves.
What we promise in return:
- A reply within two working days, from a person rather than a form.
- We'll tell you what we're doing about it, and again when it's fixed.
- We will not take legal action against you for finding it in good faith. Good faith means not digging further than you need to, leaving other people's data alone, and giving us a chance to fix it before you tell the world.
- Credit by name, if you want it. There's no money here for a bounty.