New York–based privacy and security startup Cloaked launched its apps today to let users create unique proxy emails, phone numbers, and passwords for online accounts.
The company, which was in private beta for the last two years, is now making its solution available for everyone through its web app, Chrome extension, and mobile apps (available on both Android and iOS).
Cloaked, founded by brothers Arjun and Abhijay Bhatnagar in 2020, allows users to create “identities” consisting of usernames, passwords, email addresses, and phone numbers. People can use these identities for different categories of websites such as e-commerce, social media, and newsletters, where they can avoid giving up their actual details.
The service costs $10 per month or $100 per year, with a free trial of 14 days. This subscription gives users the ability to create unlimited identities.
While Cloaked has all the password manager functionality built into the app, the startup is aiming to be much more than that. Just like Apple’s Hide My Email, it masks your real email — with Cloaked, you can also customize email addresses. Plus, if you don’t want emails to be forwarded to your ID, Cloaked can act as your inbox — unlike Firefox Relay, which just hides your email. Additionally, Cloaked will let you autofill different forms online through various identities you have stored, including one-time passwords sent to the service’s inbox.
You can also create Google Voice–like virtual numbers to use for SMS or signing up for services. Currently, the virtual phone number functionality is only available in the U.S.
The co-founders said that under the hood, Cloaked acts like a phone company.
“We don’t use Twilio or these things; we are actually a proper phone company working with a tier-one carrier. We purchase, acquire, and manage all the routing, for phone numbers. Similarly, we do the entire email routing rather than creating thin email aliases,” they said.
With the launch of its apps, Cloaked is also introducing a feature called “AutoCloak,” which essentially masks your existing credentials with a set of proxy credentials, by automatically changing your password after you sign in using the saved password. The company said this feature is available only on a limited number of sites and users are in full control of it in terms of activating or deactivating the AutoCloak feature.
Focusing on security
The company, which has raised $29 million in funding to date from investors such as Lux Capital and Human Capital, said it has been thinking about security before even building the product.
“The main hypothesis we wanted to follow was that we are not doing privacy for everyone. Our product is for people who are not privacy-centric, but have an idea about it,” the co-founders said.
“We don’t want you to change your behavior online. But we don’t want you to give up your phone, email, and eventually credit cards anywhere.”
The co-founders told TechCrunch that they store each customer’s data in separate encrypted databases so that even if their server is breached, hackers don’t get access to users’ data. This is to avoid a LastPass-like breach situation where hackers got hold of customer data, including password vaults.
Additionally, Cloaked uses a concept called data poisoning by assigning one phone number to multiple people. Then, based on who an entity or a website is trying to contact, they route the text to the right person. This way, data aggregators don’t get to know who exactly is using the proxy number. However, if a person is signing up for a service like Signal, Cloaked doesn’t assign that number to anyone else for privacy reasons.
The company said that it is working on zero-knowledge architecture so the master password users use to unlock their Cloaked profile never hits the startup’s servers. Cloaked noted that it doesn’t have any unilateral access to customer data.
The road ahead
After the launch of its apps, Cloaked is working to roll out family sharing and group sharing for identities by the end of this year. The company is also planning to integrate credit cards into identities, so users will be able to generate virtual cards they can use instead of giving out their real card numbers. The founders said that users will be able to generate an unlimited number of cards and set limits for each of them.
Cloaked is not the only company working to make privacy management easier for users through simple design and user experience workflow. Earlier in May, a16z-backed Uno launched a design-centric password manager.
Comment