falcon_
Joined 5 years ago
Karma
84
Submissions
62
Member since
Dec 29
Recent submissions
Comment · 9 months ago
Comment · 10 months ago
Because of privacy, there is no direct connection with banks.
You can upload all your transactions and balances with a single CSV/XLS file that you get on your bank. It take seconds.
Comment · 10 months ago
there are some screenshots on the landing page https://whisper.money/
Comment · 10 months ago
Hi HN — I’m Victor. I built Whisper Money, a personal finance tracker where your
financial data is end-to-end encrypted client-side before it ever reaches the
server (zero-knowledge style: the server stores ciphertext and shouldn’t see
plaintext transactions/accounts/budgets).
It’s aimed at people who want to track spending/budgets without giving a SaaS provider access to raw financial data. There are no bank connections and no AI processing — you can import transactions via CSV/XLS and everything is encrypted locally before upload/sync.
You can self-host it via Docker/docker-compose: https://github.com/whisper-money/whisper-money
There’s also a hosted version at https://whisper.money (paid).
Source is available under CC BY-NC 4.0 (non-commercial).
What I’d love feedback on from the HN crowd:
- Threat model review: what am I missing in the E2EE/“zero-knowledge” claims?
- Backup/restore expectations when encryption keys live only on clients
- What features you’d require before trusting it for real finances (e.g., OIDC/SSO, 2FA, audit logs, export formats)
Happy to answer technical questions about the architecture and encryption flow.
- Stack: Laravel 12 + React 19 + Inertia v2 + TypeScript + MySQL/Redis.
- Encryption code lives under src/lib/crypto (happy to point to specific files).
- Import is CSV/XLS; encryption happens before upload.
- Hosting/deploy: Docker + docker-compose, includes a production compose and a Coolify template.
If anyone has experience with audits / threat modeling for E2E apps, I’d appreciate pointers on what to formalize first.