Do not use this service. With less than 60 seconds of looking, you can hijack people's deadmanswitch accounts with a simple CSRF on the email change API.
If you have a "high value secret" and you are a normal person, lawyers work pretty well. If you have a "high value secret" and you're Ed Snow, something like this site is not a solution you should use because it will get you killed. Nobody has a use for this...
That said, tens of thousands of users apparently have a use for this. I'd imagine it's mostly "last goodbyes" type of stuff, also many users email me saying they want something to send "something happened to me, please come so my dog won't starve".
"Millionaire with assets" and "Ed Snowden" aren't the only two possibilities.
Suicidal tendencies, then? While you are applying the "fix" may want to add a link to suicide prevention resources.
EDIT: Added!
No, it might surprise you to learn that all humans eventually die. Some of them even have families they want to send 'death-bed' notes to.
This seems uselessly snarky, especially since StavrosK (who I assume is the developer, based on other posts) gave a polite and snark-free response already:
> That's actually probably a good idea, I will add that, thanks.
And if you host that yourself, there's a chance your credit card could get canceled and your VM/docker container/whatever gets canceled and destroyed before it does its thing. ... but I mean who cares. No you. You're dead! :-P
You pay for it ahead of time in bitcoin and build redundancy.
It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users.
This is very true - but often the author does intend to take security seriously and they've simply overlooked something. The best approach in that scenario is just to talk to them and ask them to take a look at a vuln you've found, rather than immediately telling all their potential users to stay away.
I don't imagine this service gets an enormous amount of traffic. You might be among the handful of visitors to the site who are capable of noticing the CSRF issue, and maybe even the only one to go in and look at the source. He's had an email address up on his site for a while (hi@stochastictechnologies.com). Did you report the vuln to the author when you first found it?
Anyone who "cares" about security should know about CSRF. It is one of the 3 attacks that all web devs encounter. It's trivial to find.
I'm also not sanguine about the idea of using a service which is meant to handle information of such gravity as this, and which has also had an extremely well understood, trivially fixed, and enormously compromising information disclosure vulnerability go unfixed for a year or more. The reason why that situation has obtained is not interesting to me; that that situation has obtained is enormously so.
Don't get me wrong - I think very highly of what 'StavrosK is trying to do here, and I agree that it's counterproductive not to report an issue once found in a case like this. (There's a certain degree of nuance made necessary by the fact that kill-the-messenger reflexes make vulnerability reporting so fraught in general. But that doesn't seem likely to obtain in this case, so I'd report, probably not even anonymously.) But at this point that trust just isn't coming back.