Post #4374786

2026-08-04 12:16 UTC

A year ago I made Wellness Ping because someone I care about went silent and it took too long for anyone to notice. v2.0 is now out. It now works entirely over Signal, usernames or phone numbers, both for your check-ins and for your emergency contacts. Email isn't safe for everyone to use, but it's still there. Three new security modules, all optional, stack as many as you want: PIN, authenticator 2FA, and passkeys. The PIN has a duress option. Enter that one instead and your contacts get alerted immediately, while your screen says everything went fine. (really proud of this one. tweaked to the point of obsession so that response time for a duress PIN matches a normal one. nothing on your screen or in the timing gives it away.) Also added vacation pause and custom alert messages, both of which people asked for. v2.0 got a full security review before release. The check-in path is much harder to spoof now. Details in the release PR. Free forever (as long as I'm alive) and open source. https://wellness-p.ing oh and btw, the person who went missing, for whom I made this originally, turned out to be okay. It took a lot of time and a lot of effort to find them, but I did actually find them. I thought you might want to know that.

Replies (6)

@micr0@wetdry.world 2026-08-04 12:16

For the infosec peeps, what the security pass actually fixed: Inbound email replies are now sender authenticated (DKIM/SPF with domain alignment) and have to quote a per-cycle code. Before, a spoofed From header could disarm anyone's switch, indefinitely, if you knew their address. Check-ins need an explicit POST now. Mail link scanners could fetch the confirm URL and check people in automatically. PINs are argon2id instead of one round of SHA-256. Rate limits on every auth path. CSRF tokens, strict CSP, Secure cookies, no more data races. And as mentioned, the duress PIN is also indistinguishable from a normal check-in now, same pages, same timing, so nobody watching your screen learns anything. If you self-host this or run a fork, update. Everything above applies to older versions.

Open ##4374805
@micr0@wetdry.world 2026-08-04 12:17

If you already use Wellness Ping, two things changed for you. The check-in link now takes one extra click to confirm. Mail scanners could follow the link and check people in automatically, which is bad in a fairly obvious way. And replying PONG now needs the short code printed in your check-in message. Your next one will have it. Nothing else changes. Your settings and contacts are untouched.

Open ##4374812
@micr0@wetdry.world 2026-08-04 12:20

Also worlds smallest UI update :) Before, and after

Open ##4390065
@micr0@wetdry.world 2026-08-04 23:26

Patched the bug where Signal usernames were limited to 2 discriminators, added an extra step in signup to hopefully make less ratelimit issues. Since there is still a big signup wave know service can be patchy, but for those who have already signed up signal rate limits don't affect you so everything works! Once you've signed up. Did the update on my pc right after I woke up, and now typing this as I walk to uni, will try to get to any other issues after uni

Open ##4390067
@seq@infosec.exchange 2026-08-05 21:04

@micr0@wetdry.world Well, that's just a bloody beautiful thing to develop. The world needs more people like you.

Open ##4395014
@micr0@wetdry.world 2026-08-04 12:24

i keep wanna saying things i am proud of here but i am proud of all of it lol, but by far the security modules are the coolest... signal support is cool too but it was kinda like expected for v2.0 yk?

Open ##4408444