6 ms·

I've had a thought for a while about how to share the master key to my password manager when I die (so family can access bank accounts, etc.). One thing I thoug

I've had a thought for a while about how to share the master key to my password manager when I die (so family can access bank accounts, etc.). One thing I thought of was to use Google's 'inactive account' feature to give access to a file someone I know when my account is inactive for 90 days. But that's such a long time period, and my loved ones might need that data in the meantime. Another thought I had was to use some secret sharding scheme like this, but the venn diagram of people that I trust with the data, and the people who could competently carry out guarding and then revealing the secret is too small. Looks like Lastpass has a solution[0], but it also involves a waiting period. And I'd love something that's open source and self hosted. Does anyone have a good solution? [0] https://blog.lastpass.com/2016/07/how-to-get-started-with-lastpass-emergency-access/ https://blog.lastpass.com/2016/07/how-to-get-started-with-la...

jsmith99 5y ago
Bitwarden has a similar Emergency Access feature and can be self hosted.
derefnull 5y ago
I think technology may serve as a liability here. There are stories around the net of people forgetting to reset the "deadman switch" on their solution, and their contacts are supplied with an errant death notice. Have you considered low/no tech solutions? Along with a living will (should you become incapacitated,) access to account passwords may assist your family/friends in taking care of your estate when you are unable. It could be as simple as providing a password list in a sealed envelope to someone you trust to serve your best interests, should their assistance be required A lawyer may also be willing to provide this service to you
berdon 5y ago
How about a Yubikey configured such that the tap emits a static password that’s then left with a lawyer to be transferred as a part of a will?
- buro9 5y ago
  This is what I do. I yubikey with two slots... the long press is the master password to my password manager and is stored securely with my will, key papers and instructions as to how to unlock everything else. My partner and closest living relative know who to contact to obtain this.
hguant 5y ago
I think writing down your master password, or the hard recovery keys, on a piece of paper, and storing that with your lawyer or in a safety deposit box accessible by your lawyer/executor of your estate is the correct way to go about this. I feel like there isn't really a strong need for a purely technical solution here, when the problem of "get information to person or persons after my death" has been largely solved by the legal and banking system.
- remram 5y ago
  Or maybe part of the password, and give the other part to the intended recipient now. So that your lawyer/executor/banker can't get into everything if they get breached/criminal/warrant.
secondaryacct 5y ago
Why not pay a notary to store your will or a bank safe ? I mean you re inventing solutions to problems we always solved with a fee and a legally binding contract...
- WorldMaker 5y ago
  Related to this, I briefly explored the idea of digital secret sharing tech for lawyers/notaries to use as a service in Estate Planning. Certainly not "zero trust" and you'd still want the usual YGWYPF and contract law to back it up. Ran into some huge hurdles. The idea was to be a somewhat safer "digital escrow" ("safety deposit box") in the cloud providing artifacts that could be placed in wills or real world safety deposit boxes. The first and obvious being generally lawyers aren't as tech savvy as they should be and building a good UX for that is likely a very hard problem. (But the real problem I got into in casual conversations picking lawyer brains to see if there was a viable MVP to try to build was what I felt to be the real serious Digital Escrow whammy that we're going to maybe need decades to fix: digital goods survivorship isn't an established right. Most Terms of Service agreements forbid, indirectly or directly giving someone else your password. Worse, many Terms of Services explicitly are being written between only one specific individual and the company and have clauses that terminate with the individual. A lawyer asked to write a password into an estate plan doesn't have to think about what it protects and doesn't need to know and passwords on paper stored in a safety deposit box are mostly covered/secured by existing contract law and insurance and all that. [But also you can't update that password without the rigmarole of paying the lawyer to open the file in the safety deposit box and updating the document.] But even in just casual conversations, asking if password and digital "item" storage/escrow as a service was useful to lawyers led them down into frightening rabbit holes that Digital Estate Planning is a giant mess, the contracts [Terms of Services] are nightmares, most companies don't want to consider digital goods as inheritable goods, and the legal fights over inheritance rights of things like Steam accounts or Movies Anywhere or Kindle accounts are just waiting to happen and lawyers would generally prefer to ostrich that as long as possible unless someone pays them heavily or someone else sets a good first precedent. I still think about some of these problems and how unprepared we currently are with respect to "digital goods".)
kingcharles 5y ago
As someone who unexpectedly went to jail and lost access to the Internet for many years, I have thought about this too. Make sure if you have any 2FA that your family can get access to your 2FA device - e.g. get to your text messages, get to your Authenticator app. It's no good for them to have your usernames and passwords if they still can't get in. If your phone dies with you (say you're in a plane crash), how will they complete the 2FA?
latexr 5y ago
If you use Apple products, Digital Legacy may help: https://digital-legacy.apple.com https://digital-legacy.apple.com

jsmith99 5y ago

Bitwarden has a similar Emergency Access feature and can be self hosted.

derefnull 5y ago

I think technology may serve as a liability here. There are stories around the net of people forgetting to reset the "deadman switch" on their solution, and their contacts are supplied with an errant death notice. Have you considered low/no tech solutions? Along with a living will (should you become incapacitated,) access to account passwords may assist your family/friends in taking care of your estate when you are unable. It could be as simple as providing a password list in a sealed envelope to someone you trust to serve your best interests, should their assistance be required A lawyer may also be willing to provide this service to you

berdon 5y ago

How about a Yubikey configured such that the tap emits a static password that’s then left with a lawyer to be transferred as a part of a will?

buro9 5y ago
This is what I do. I yubikey with two slots... the long press is the master password to my password manager and is stored securely with my will, key papers and instructions as to how to unlock everything else. My partner and closest living relative know who to contact to obtain this.

hguant 5y ago

I think writing down your master password, or the hard recovery keys, on a piece of paper, and storing that with your lawyer or in a safety deposit box accessible by your lawyer/executor of your estate is the correct way to go about this. I feel like there isn't really a strong need for a purely technical solution here, when the problem of "get information to person or persons after my death" has been largely solved by the legal and banking system.

remram 5y ago
Or maybe part of the password, and give the other part to the intended recipient now. So that your lawyer/executor/banker can't get into everything if they get breached/criminal/warrant.

secondaryacct 5y ago

Why not pay a notary to store your will or a bank safe ? I mean you re inventing solutions to problems we always solved with a fee and a legally binding contract...

WorldMaker 5y ago
Related to this, I briefly explored the idea of digital secret sharing tech for lawyers/notaries to use as a service in Estate Planning. Certainly not "zero trust" and you'd still want the usual YGWYPF and contract law to back it up. Ran into some huge hurdles. The idea was to be a somewhat safer "digital escrow" ("safety deposit box") in the cloud providing artifacts that could be placed in wills or real world safety deposit boxes. The first and obvious being generally lawyers aren't as tech savvy as they should be and building a good UX for that is likely a very hard problem. (But the real problem I got into in casual conversations picking lawyer brains to see if there was a viable MVP to try to build was what I felt to be the real serious Digital Escrow whammy that we're going to maybe need decades to fix: digital goods survivorship isn't an established right. Most Terms of Service agreements forbid, indirectly or directly giving someone else your password. Worse, many Terms of Services explicitly are being written between only one specific individual and the company and have clauses that terminate with the individual. A lawyer asked to write a password into an estate plan doesn't have to think about what it protects and doesn't need to know and passwords on paper stored in a safety deposit box are mostly covered/secured by existing contract law and insurance and all that. [But also you can't update that password without the rigmarole of paying the lawyer to open the file in the safety deposit box and updating the document.] But even in just casual conversations, asking if password and digital "item" storage/escrow as a service was useful to lawyers led them down into frightening rabbit holes that Digital Estate Planning is a giant mess, the contracts [Terms of Services] are nightmares, most companies don't want to consider digital goods as inheritable goods, and the legal fights over inheritance rights of things like Steam accounts or Movies Anywhere or Kindle accounts are just waiting to happen and lawyers would generally prefer to ostrich that as long as possible unless someone pays them heavily or someone else sets a good first precedent. I still think about some of these problems and how unprepared we currently are with respect to "digital goods".)

kingcharles 5y ago

As someone who unexpectedly went to jail and lost access to the Internet for many years, I have thought about this too. Make sure if you have any 2FA that your family can get access to your 2FA device - e.g. get to your text messages, get to your Authenticator app. It's no good for them to have your usernames and passwords if they still can't get in. If your phone dies with you (say you're in a plane crash), how will they complete the 2FA?

latexr 5y ago

If you use Apple products, Digital Legacy may help: https://digital-legacy.apple.com https://digital-legacy.apple.com