6 ms·

Dark Crystal

etskinner 5y ago
I've had a thought for a while about how to share the master key to my password manager when I die (so family can access bank accounts, etc.). One thing I thought of was to use Google's 'inactive account' feature to give access to a file someone I know when my account is inactive for 90 days. But that's such a long time period, and my loved ones might need that data in the meantime. Another thought I had was to use some secret sharding scheme like this, but the venn diagram of people that I trust with the data, and the people who could competently carry out guarding and then revealing the secret is too small. Looks like Lastpass has a solution[0], but it also involves a waiting period. And I'd love something that's open source and self hosted. Does anyone have a good solution? [0] https://blog.lastpass.com/2016/07/how-to-get-started-with-lastpass-emergency-access/ https://blog.lastpass.com/2016/07/how-to-get-started-with-la...
- jsmith99 5y ago
  Bitwarden has a similar Emergency Access feature and can be self hosted.
- derefnull 5y ago
  I think technology may serve as a liability here. There are stories around the net of people forgetting to reset the "deadman switch" on their solution, and their contacts are supplied with an errant death notice. Have you considered low/no tech solutions? Along with a living will (should you become incapacitated,) access to account passwords may assist your family/friends in taking care of your estate when you are unable. It could be as simple as providing a password list in a sealed envelope to someone you trust to serve your best interests, should their assistance be required A lawyer may also be willing to provide this service to you
- berdon 5y ago
  How about a Yubikey configured such that the tap emits a static password that’s then left with a lawyer to be transferred as a part of a will?
  - buro9 5y ago
    This is what I do. I yubikey with two slots... the long press is the master password to my password manager and is stored securely with my will, key papers and instructions as to how to unlock everything else. My partner and closest living relative know who to contact to obtain this.
- hguant 5y ago
  I think writing down your master password, or the hard recovery keys, on a piece of paper, and storing that with your lawyer or in a safety deposit box accessible by your lawyer/executor of your estate is the correct way to go about this. I feel like there isn't really a strong need for a purely technical solution here, when the problem of "get information to person or persons after my death" has been largely solved by the legal and banking system.
  - remram 5y ago
    Or maybe part of the password, and give the other part to the intended recipient now. So that your lawyer/executor/banker can't get into everything if they get breached/criminal/warrant.
- secondaryacct 5y ago
  Why not pay a notary to store your will or a bank safe ? I mean you re inventing solutions to problems we always solved with a fee and a legally binding contract...
  - WorldMaker 5y ago
    Related to this, I briefly explored the idea of digital secret sharing tech for lawyers/notaries to use as a service in Estate Planning. Certainly not "zero trust" and you'd still want the usual YGWYPF and contract law to back it up. Ran into some huge hurdles. The idea was to be a somewhat safer "digital escrow" ("safety deposit box") in the cloud providing artifacts that could be placed in wills or real world safety deposit boxes. The first and obvious being generally lawyers aren't as tech savvy as they should be and building a good UX for that is likely a very hard problem. (But the real problem I got into in casual conversations picking lawyer brains to see if there was a viable MVP to try to build was what I felt to be the real serious Digital Escrow whammy that we're going to maybe need decades to fix: digital goods survivorship isn't an established right. Most Terms of Service agreements forbid, indirectly or directly giving someone else your password. Worse, many Terms of Services explicitly are being written between only one specific individual and the company and have clauses that terminate with the individual. A lawyer asked to write a password into an estate plan doesn't have to think about what it protects and doesn't need to know and passwords on paper stored in a safety deposit box are mostly covered/secured by existing contract law and insurance and all that. [But also you can't update that password without the rigmarole of paying the lawyer to open the file in the safety deposit box and updating the document.] But even in just casual conversations, asking if password and digital "item" storage/escrow as a service was useful to lawyers led them down into frightening rabbit holes that Digital Estate Planning is a giant mess, the contracts [Terms of Services] are nightmares, most companies don't want to consider digital goods as inheritable goods, and the legal fights over inheritance rights of things like Steam accounts or Movies Anywhere or Kindle accounts are just waiting to happen and lawyers would generally prefer to ostrich that as long as possible unless someone pays them heavily or someone else sets a good first precedent. I still think about some of these problems and how unprepared we currently are with respect to "digital goods".)
- kingcharles 5y ago
  As someone who unexpectedly went to jail and lost access to the Internet for many years, I have thought about this too. Make sure if you have any 2FA that your family can get access to your 2FA device - e.g. get to your text messages, get to your Authenticator app. It's no good for them to have your usernames and passwords if they still can't get in. If your phone dies with you (say you're in a plane crash), how will they complete the 2FA?
- latexr 5y ago
  If you use Apple products, Digital Legacy may help: https://digital-legacy.apple.com https://digital-legacy.apple.com
hootbootscoot 5y ago
and here i thought this was about undocumented behavior in a programming language... https://crystal-lang.org/ https://crystal-lang.org/
- hnlmorg 5y ago
  There's also a cult classic movie called Dark Crystal: https://www.imdb.com/title/tt0083791/ https://www.imdb.com/title/tt0083791/ I actually wouldn't be surprised if this project was named after that movie as their project logo looks similar to the crystal in that movie (but that could just be coincidental).
  - jacquesm 5y ago
    That's what I was hoping for: HN's treatment of Hensons' masterpiece. Pity.
  - Veen 5y ago
    There's a pretty good Netflix Dark Crystal show too. Also made by the Henson company: https://en.wikipedia.org/wiki/The_Dark_Crystal:_Age_of_Resistance https://en.wikipedia.org/wiki/The_Dark_Crystal:_Age_of_Resis... Unfortunately it was cancelled after one season.
agapelojong 5y ago
Great use of the .pw tld, especially if the .com was out of reach.
amelius 5y ago
Offtopic. Let's keep the word "dark" for sinister things, like "dark patterns".
- tomrod 5y ago
  Actually, I prefer to use dark as a descriptor for a wide arrange of things that are non-sinister. There is a lurid racist history to using the word dark for sinister, in the oddest of corners. For example, the racial history of the Mormon church has extremely strong connotations in their sacred writ for "dark" meaning sinful. Obviously melanin in the skin doesn't correlate to scrupulosity or zealotry -- but in the minds of its 19th century author(s) it does. Similarly, during my few years sojourning in the Philippines, dark skin was seen as socially undesirable because American television typically portrayed beautiful people as white. These are hogwash notions, but reinforced by a desire to equate bad/immoral with a color scheme. So, I don't personally feel we need to restrict dark to negative connotations, simply because dark isn't negative by itself, nor is luminous always a positive (e.g. JWST likes the dark for pictures).
  - gmfawcett 5y ago
    > There is a lurid racist history to using the word dark for sinister. As a left-handed person, I'm aware that there's also a lurid history of using the word 'sinister' to mean 'evil'. :) https://www.merriam-webster.com/words-at-play/sinister-left-dexter-right-history https://www.merriam-webster.com/words-at-play/sinister-left-...
- lisper 5y ago
  The name is an allusion to a children's movie: https://en.wikipedia.org/wiki/The_Dark_Crystal https://en.wikipedia.org/wiki/The_Dark_Crystal
codeptualize 5y ago
Is it just me or does the social recovery system sound tricky? I'm thinking phishing, social engineering, threats, but also people often trust the wrong people, relationships don't always last, and sadly people die. Especially for very important and sensitive stuff I'd say there are better alternatives.
- amosj 5y ago
  sincere question: what are the better alternatives? Do any have a (different) key technological component or do they mostly rely on other non-technology-based trust channels like a notary or a lawyer, as other comments have mentioned?
  - codeptualize 5y ago
    I'm by no means an expert so take everything with a grain of salt. Notary/lawyer/safety deposit box do sound like proper solutions. I also think 2nd factors like hardware keys, auth apps, also just multiple devices you have logged in, work well in recovery. For after you die notary/lawyer sounds like the most solid option, they seem quite skilled and experienced with that kind of stuff. Otherwise you need some other way to recover. Recovery email seems to work quite well, but could be another account, another type of log in, there are many ways; I've had some services send me a physical letter, I have gone to physical stores with my id. Nothing is perfect of course, but the social one seems unnecessary complex and fragile.
encryptluks2 5y ago
After looking at the website it doesn't make it very clear what this even offers. It seems like just fluff honestly.
olodus 5y ago
Have been looking at the Magma collective's stuff a few times in the past. They work on interesting stuff. Especially the distributed file storage stuff.
still_grokking 5y ago
Oh, a project baked by a German ministry and some crypto scam? Highest trust levels given here… ;-) On a more serous note: Germany is a digitally failed state. I can say that for sure as I'm living here my whole live. Just everything that involves state authorities is a big failure. It's all nepotism, burning taxpayer's hard earned money for extremely doubtful projects that fall apart like a house of cards when you look askance on them. One IT related failure marches after the other. There are literally no success stories. It's not only a popular joke that Germany's government IT is made up of fax and printed internet pages. That's actually the truth! (We had to learn this once again the hard way during the pandemic…) So if an IT related project has a federal ministry badge on it you should be at least very skeptical. (Or even better, you should start running not looking back). This, paired with advertisement form the Ethereum foundation, is more than enough for me to assume this is a complete failure. If I would be willing to spend time looking into the details I'm very sure this would turn out to be some complete useless nonsense. (As the "five block-chain" COVID check-in app with a central privately hold database in the back-end lately; which of course failed miserably. Since than the joke is that every new government IT project needs to include at least five block-chains, otherwise it's not worth it). Long story short: The people giving away money for such things don't have the slightest clue about anything IT related. They constantly make business with the most scummy "partners" resulting in usually hundreds of millions of euros getting burned for literary nothing (besides the partners, and other friends of the involved politicians, getting rich in the process).
- detaro 5y ago
  The specific case of Prototype-Fund, which is what's linked on the page, is not perfect but far from the usual level of mess you reference. It's small-scale (<50k€) funding for a wide range of projects.
kazinator 5y ago
The Dark Crystal is also a trope-laden, cheesy (though critically acclaimed) puppet-action fantasy movie from 1982, whose making involved Jim Henson (of The Muppet Show fame). One horcrux-like trope central to the plot is that a missing shard from a crystal (the Crystal of Truth) must be found and reunited with the crystal to put the broken world back in order again.

I've had a thought for a while about how to share the master key to my password manager when I die (so family can access bank accounts, etc.). One thing I thought of was to use Google's 'inactive account' feature to give access to a file someone I know when my account is inactive for 90 days. But that's such a long time period, and my loved ones might need that data in the meantime. Another thought I had was to use some secret sharding scheme like this, but the venn diagram of people that I trust with the data, and the people who could competently carry out guarding and then revealing the secret is too small. Looks like Lastpass has a solution[0], but it also involves a waiting period. And I'd love something that's open source and self hosted. Does anyone have a good solution? [0] https://blog.lastpass.com/2016/07/how-to-get-started-with-lastpass-emergency-access/ https://blog.lastpass.com/2016/07/how-to-get-started-with-la...

jsmith99 5y ago
Bitwarden has a similar Emergency Access feature and can be self hosted.
derefnull 5y ago
I think technology may serve as a liability here. There are stories around the net of people forgetting to reset the "deadman switch" on their solution, and their contacts are supplied with an errant death notice. Have you considered low/no tech solutions? Along with a living will (should you become incapacitated,) access to account passwords may assist your family/friends in taking care of your estate when you are unable. It could be as simple as providing a password list in a sealed envelope to someone you trust to serve your best interests, should their assistance be required A lawyer may also be willing to provide this service to you
berdon 5y ago
How about a Yubikey configured such that the tap emits a static password that’s then left with a lawyer to be transferred as a part of a will?
- buro9 5y ago
  This is what I do. I yubikey with two slots... the long press is the master password to my password manager and is stored securely with my will, key papers and instructions as to how to unlock everything else. My partner and closest living relative know who to contact to obtain this.
hguant 5y ago
I think writing down your master password, or the hard recovery keys, on a piece of paper, and storing that with your lawyer or in a safety deposit box accessible by your lawyer/executor of your estate is the correct way to go about this. I feel like there isn't really a strong need for a purely technical solution here, when the problem of "get information to person or persons after my death" has been largely solved by the legal and banking system.
- remram 5y ago
  Or maybe part of the password, and give the other part to the intended recipient now. So that your lawyer/executor/banker can't get into everything if they get breached/criminal/warrant.
secondaryacct 5y ago
Why not pay a notary to store your will or a bank safe ? I mean you re inventing solutions to problems we always solved with a fee and a legally binding contract...
- WorldMaker 5y ago
  Related to this, I briefly explored the idea of digital secret sharing tech for lawyers/notaries to use as a service in Estate Planning. Certainly not "zero trust" and you'd still want the usual YGWYPF and contract law to back it up. Ran into some huge hurdles. The idea was to be a somewhat safer "digital escrow" ("safety deposit box") in the cloud providing artifacts that could be placed in wills or real world safety deposit boxes. The first and obvious being generally lawyers aren't as tech savvy as they should be and building a good UX for that is likely a very hard problem. (But the real problem I got into in casual conversations picking lawyer brains to see if there was a viable MVP to try to build was what I felt to be the real serious Digital Escrow whammy that we're going to maybe need decades to fix: digital goods survivorship isn't an established right. Most Terms of Service agreements forbid, indirectly or directly giving someone else your password. Worse, many Terms of Services explicitly are being written between only one specific individual and the company and have clauses that terminate with the individual. A lawyer asked to write a password into an estate plan doesn't have to think about what it protects and doesn't need to know and passwords on paper stored in a safety deposit box are mostly covered/secured by existing contract law and insurance and all that. [But also you can't update that password without the rigmarole of paying the lawyer to open the file in the safety deposit box and updating the document.] But even in just casual conversations, asking if password and digital "item" storage/escrow as a service was useful to lawyers led them down into frightening rabbit holes that Digital Estate Planning is a giant mess, the contracts [Terms of Services] are nightmares, most companies don't want to consider digital goods as inheritable goods, and the legal fights over inheritance rights of things like Steam accounts or Movies Anywhere or Kindle accounts are just waiting to happen and lawyers would generally prefer to ostrich that as long as possible unless someone pays them heavily or someone else sets a good first precedent. I still think about some of these problems and how unprepared we currently are with respect to "digital goods".)
kingcharles 5y ago
As someone who unexpectedly went to jail and lost access to the Internet for many years, I have thought about this too. Make sure if you have any 2FA that your family can get access to your 2FA device - e.g. get to your text messages, get to your Authenticator app. It's no good for them to have your usernames and passwords if they still can't get in. If your phone dies with you (say you're in a plane crash), how will they complete the 2FA?
latexr 5y ago
If you use Apple products, Digital Legacy may help: https://digital-legacy.apple.com https://digital-legacy.apple.com

hootbootscoot 5y ago

and here i thought this was about undocumented behavior in a programming language... https://crystal-lang.org/ https://crystal-lang.org/

hnlmorg 5y ago
There's also a cult classic movie called Dark Crystal: https://www.imdb.com/title/tt0083791/ https://www.imdb.com/title/tt0083791/ I actually wouldn't be surprised if this project was named after that movie as their project logo looks similar to the crystal in that movie (but that could just be coincidental).
- jacquesm 5y ago
  That's what I was hoping for: HN's treatment of Hensons' masterpiece. Pity.
- Veen 5y ago
  There's a pretty good Netflix Dark Crystal show too. Also made by the Henson company: https://en.wikipedia.org/wiki/The_Dark_Crystal:_Age_of_Resistance https://en.wikipedia.org/wiki/The_Dark_Crystal:_Age_of_Resis... Unfortunately it was cancelled after one season.

agapelojong 5y ago

Great use of the .pw tld, especially if the .com was out of reach.

amelius 5y ago

Offtopic. Let's keep the word "dark" for sinister things, like "dark patterns".

tomrod 5y ago
Actually, I prefer to use dark as a descriptor for a wide arrange of things that are non-sinister. There is a lurid racist history to using the word dark for sinister, in the oddest of corners. For example, the racial history of the Mormon church has extremely strong connotations in their sacred writ for "dark" meaning sinful. Obviously melanin in the skin doesn't correlate to scrupulosity or zealotry -- but in the minds of its 19th century author(s) it does. Similarly, during my few years sojourning in the Philippines, dark skin was seen as socially undesirable because American television typically portrayed beautiful people as white. These are hogwash notions, but reinforced by a desire to equate bad/immoral with a color scheme. So, I don't personally feel we need to restrict dark to negative connotations, simply because dark isn't negative by itself, nor is luminous always a positive (e.g. JWST likes the dark for pictures).
- gmfawcett 5y ago
  > There is a lurid racist history to using the word dark for sinister. As a left-handed person, I'm aware that there's also a lurid history of using the word 'sinister' to mean 'evil'. :) https://www.merriam-webster.com/words-at-play/sinister-left-dexter-right-history https://www.merriam-webster.com/words-at-play/sinister-left-...
lisper 5y ago
The name is an allusion to a children's movie: https://en.wikipedia.org/wiki/The_Dark_Crystal https://en.wikipedia.org/wiki/The_Dark_Crystal

codeptualize 5y ago

Is it just me or does the social recovery system sound tricky? I'm thinking phishing, social engineering, threats, but also people often trust the wrong people, relationships don't always last, and sadly people die. Especially for very important and sensitive stuff I'd say there are better alternatives.

amosj 5y ago
sincere question: what are the better alternatives? Do any have a (different) key technological component or do they mostly rely on other non-technology-based trust channels like a notary or a lawyer, as other comments have mentioned?
- codeptualize 5y ago
  I'm by no means an expert so take everything with a grain of salt. Notary/lawyer/safety deposit box do sound like proper solutions. I also think 2nd factors like hardware keys, auth apps, also just multiple devices you have logged in, work well in recovery. For after you die notary/lawyer sounds like the most solid option, they seem quite skilled and experienced with that kind of stuff. Otherwise you need some other way to recover. Recovery email seems to work quite well, but could be another account, another type of log in, there are many ways; I've had some services send me a physical letter, I have gone to physical stores with my id. Nothing is perfect of course, but the social one seems unnecessary complex and fragile.

encryptluks2 5y ago

After looking at the website it doesn't make it very clear what this even offers. It seems like just fluff honestly.

olodus 5y ago

Have been looking at the Magma collective's stuff a few times in the past. They work on interesting stuff. Especially the distributed file storage stuff.

still_grokking 5y ago

Oh, a project baked by a German ministry and some crypto scam? Highest trust levels given here… ;-) On a more serous note: Germany is a digitally failed state. I can say that for sure as I'm living here my whole live. Just everything that involves state authorities is a big failure. It's all nepotism, burning taxpayer's hard earned money for extremely doubtful projects that fall apart like a house of cards when you look askance on them. One IT related failure marches after the other. There are literally no success stories. It's not only a popular joke that Germany's government IT is made up of fax and printed internet pages. That's actually the truth! (We had to learn this once again the hard way during the pandemic…) So if an IT related project has a federal ministry badge on it you should be at least very skeptical. (Or even better, you should start running not looking back). This, paired with advertisement form the Ethereum foundation, is more than enough for me to assume this is a complete failure. If I would be willing to spend time looking into the details I'm very sure this would turn out to be some complete useless nonsense. (As the "five block-chain" COVID check-in app with a central privately hold database in the back-end lately; which of course failed miserably. Since than the joke is that every new government IT project needs to include at least five block-chains, otherwise it's not worth it). Long story short: The people giving away money for such things don't have the slightest clue about anything IT related. They constantly make business with the most scummy "partners" resulting in usually hundreds of millions of euros getting burned for literary nothing (besides the partners, and other friends of the involved politicians, getting rich in the process).

detaro 5y ago
The specific case of Prototype-Fund, which is what's linked on the page, is not perfect but far from the usual level of mess you reference. It's small-scale (<50k€) funding for a wide range of projects.

kazinator 5y ago

The Dark Crystal is also a trope-laden, cheesy (though critically acclaimed) puppet-action fantasy movie from 1982, whose making involved Jim Henson (of The Muppet Show fame). One horcrux-like trope central to the plot is that a missing shard from a crystal (the Crystal of Truth) must be found and reunited with the crystal to put the broken world back in order again.