4 ms·

My current approach to this problem is a feature of LastPass - if a designated person requests access to your account, and you don't respond within [x] days, th

My current approach to this problem is a feature of LastPass - if a designated person requests access to your account, and you don't respond within [x] days, then they are granted access. I set this to be the people necessary for after-life management. I know this doesn't answer all of the details you've asked about, but it is a mechanism for leaving the authentication details and instructions for those who remain after us.

gruez 9y ago
>if a designated person requests access to your account, and you don't respond within [x] days, then they are granted access isn't this wildly insecure? at the very least it means lastpass can read all your passwords at any time.
- eccbits 9y ago
  Laspass is massively insecure in all aspects of its design & history - including many facepalm-worthy breaches... It's terrible.
  - n3d1m 9y ago
    Off topic, but what makes you say LastPass is insecure, provided of course that you follow common sense rules like strong master password + 2FA?
  - corobo 9y ago
    As someone who uses the service, could you go into detail? Please do consider this a sincere query to your claim, I would like to know more
    - tbyehl 9y ago
      Wikipedia has a good overview of their (known) security lapses. Two server breaches, one known to have exfiltrated sensitive information. Several browser plugin vulnerabilities, one of which allowed arbitrary plaintext passwords to be stolen. https://en.m.wikipedia.org/wiki/LastPass#2011_security_breach https://en.m.wikipedia.org/wiki/LastPass#2011_security_breac... LastPass’s history is troubling but they’re also the biggest target out there. IMO, the entire space of “cloud” password managers is inherently untrustworthy.
  - deadbunny 9y ago
    Nothing like a bit of hyperbole in the morning.
- chrisfosterelli 9y ago
  The feature requires that the designated person has a Lastpass account. This works then because each Lastpass user has a public key, and private key encrypted inside their vault. When you designate someone for emergency access, it also encrypts your vault with their public key. In a way the person and Lastpass hold each other accountable because: 1. Lastpass only gives the encrypted vault data to the emergency contact after the waiting period. They cannot decrypt the vault without having the encrypted vault data. 2. The person's private key is encrypted inside their vault by their master password. As lastpass doesn't know their master password for their vault, lastpass doesn't have the key to your vault. I would not call this "wildly insecure", but definitely has more risk factors than not doing it. For most people I think this is a reasonable tradeoff if they want people to be able to access their data without huge inconvenience.
  - gruez 9y ago
    thanks, I didn't consider pre-encrypting the data with the recipient's key ahead of time.
- zeroxfe 9y ago
  > at the very least it means lastpass can read all your passwords at any time. Not if it's been done right. They'd use some kind of multi-key secret sharing scheme (like shamir), where the password database would be encrypted with the public keys of both lastpass (the custodian) and the designated person. (This would be done on the client side, by the designator.)
emill8888 9y ago
I also use this Lastpass feature but take it one step farther. I have all the info stored on copies of encrypted usb drives stored in multiple secure locations that my loved ones have access to. The password is stored on Lastpass. So if I croak they can request the password but also need physical access to the thumb drive. I have set up the same for other family members with assets worth protecting. Of course this all fails hard if Lastpass disappears, anyone have a better replacement?
kc10 9y ago
I exactly did the same thing. But in addition to this, pretty much all the underlying accounts are 2FA enabled, if they support it. We use Authy to manage 2FA tokens and have it installed on my phone and my wife's phone.

gruez 9y ago

>if a designated person requests access to your account, and you don't respond within [x] days, then they are granted access isn't this wildly insecure? at the very least it means lastpass can read all your passwords at any time.

eccbits 9y ago
Laspass is massively insecure in all aspects of its design & history - including many facepalm-worthy breaches... It's terrible.
- n3d1m 9y ago
  Off topic, but what makes you say LastPass is insecure, provided of course that you follow common sense rules like strong master password + 2FA?
- corobo 9y ago
  As someone who uses the service, could you go into detail? Please do consider this a sincere query to your claim, I would like to know more
  - tbyehl 9y ago
    Wikipedia has a good overview of their (known) security lapses. Two server breaches, one known to have exfiltrated sensitive information. Several browser plugin vulnerabilities, one of which allowed arbitrary plaintext passwords to be stolen. https://en.m.wikipedia.org/wiki/LastPass#2011_security_breach https://en.m.wikipedia.org/wiki/LastPass#2011_security_breac... LastPass’s history is troubling but they’re also the biggest target out there. IMO, the entire space of “cloud” password managers is inherently untrustworthy.
- deadbunny 9y ago
  Nothing like a bit of hyperbole in the morning.
chrisfosterelli 9y ago
The feature requires that the designated person has a Lastpass account. This works then because each Lastpass user has a public key, and private key encrypted inside their vault. When you designate someone for emergency access, it also encrypts your vault with their public key. In a way the person and Lastpass hold each other accountable because: 1. Lastpass only gives the encrypted vault data to the emergency contact after the waiting period. They cannot decrypt the vault without having the encrypted vault data. 2. The person's private key is encrypted inside their vault by their master password. As lastpass doesn't know their master password for their vault, lastpass doesn't have the key to your vault. I would not call this "wildly insecure", but definitely has more risk factors than not doing it. For most people I think this is a reasonable tradeoff if they want people to be able to access their data without huge inconvenience.
- gruez 9y ago
  thanks, I didn't consider pre-encrypting the data with the recipient's key ahead of time.
zeroxfe 9y ago
> at the very least it means lastpass can read all your passwords at any time. Not if it's been done right. They'd use some kind of multi-key secret sharing scheme (like shamir), where the password database would be encrypted with the public keys of both lastpass (the custodian) and the designated person. (This would be done on the client side, by the designator.)

emill8888 9y ago

I also use this Lastpass feature but take it one step farther. I have all the info stored on copies of encrypted usb drives stored in multiple secure locations that my loved ones have access to. The password is stored on Lastpass. So if I croak they can request the password but also need physical access to the thumb drive. I have set up the same for other family members with assets worth protecting. Of course this all fails hard if Lastpass disappears, anyone have a better replacement?

kc10 9y ago

I exactly did the same thing. But in addition to this, pretty much all the underlying accounts are 2FA enabled, if they support it. We use Authy to manage 2FA tokens and have it installed on my phone and my wife's phone.