Show HN: Pawl – iOS gambling blocker you unlock with a physical Security Key
github.com
I built this to make unblocking apps on your phone a lot harder. You add a physical key, then put it out of reach or give it to a friend, so unblocking becomes a real hassle. I started out wanting to build software around hardware security keys. My thinking was that they belong in high stakes moments, where proving it's really you matters the most.
One of those scenarios is gambling/unblocking apps on your phone. A hardware key is a physical thing you have to go find, plug in, and tap. That makes it a good fit for moments where the user isn't 100% sure they want to unblock something. Gambling is one of those moments. You can lose a lot of money when nobody else has to verify/authenticate your behavior.
So I built Pawl. You can use it alone, or with a sponsor/spouse/partner who approves each unlock. It uses Apple's built in Screen Time API, enabling you to block adult sites, gambling, and/or apps of your choosing.
There is no unlock button in the app, you have to plug in your security key (that you put out of reach) and authenticate that you truly want to unblock apps/websites. After that, you wait 15 minutes. Then the block will turn back on after 30 minutes. This is customizable. Your clean day streak is saved in iCloud, so deleting the app doesn't reset it.
The app is free on iPhone and iPad, with an optional Pro subscription for $3.99 a month or yearly $29.99 (w/ a free week). I built Pawl with Swift and SwiftUI and the sponsor feature runs on Supabase. It's open source under MPL 2.0 as of yesterday so more people can find bugs and audit it for safety. One developer is working on this so far. It's also been a while since I worked on this project because I work on a lot of projects lol.
Some limits of this app are: the phone's owner can turn Screen Time off (no app can prevent this). The key check compares the credential ID but does not verify the signature. The clock lock is in the code but not switched on yet. Most of the code has no automated tests, and there are no reproducible builds.
Side note: I'm an enrolled member of the Confederated Tribes of Grand Ronde in Oregon, the tribe that owns Spirit Mountain Casino. So this is a real problem for my reservation and community. A lot of our per capita payments go straight back into the casino at the end of every other month, when that money should be going to basic needs and the future.
Links:
App Store: https://apps.apple.com/app/id6783119309 (my mom is the only review lol)
Website: https://getpawl.com
Privacy: https://getpawl.com/privacy.html
Report a security issue: https://github.com/jasonepage/Pawl/blob/main/SECURITY.md