10 ms·

These are fun thought experiments, but I think having a personal Disaster Recovery plan is a far more applicable security exercise. What would you do if you los

• CameronNemo 5y ago
  If you forgot your password manager master password? Short of brain damage, I don't think that would ever happen. It would be a hassle for my family if I died, though. I'm young, but I should still get that scenario worked out.
  • b112 5y ago
    With a death certificate, you don't need passwords, or even account numbers, to access savings, accounts at fiscal types of businesses. It helps pf course, to have account info, but just knowing the place of business is typically enough. For clarity, living people lose account numbers and access all the time. The death cert. gives you this same power.
    • philjohn 5y ago
      Not for, eg, lastpass. Your master password is the key that decrypts your password vault. Some sort of escrow would be good, that unlocks a document with access instructions upon receipt of a valid death certificate.
      • CamelRocketFish 5y ago
        Yes but lastpass contains your password to something like your bank account. You don’t need your password for your bank account if you have a death certificate is what the poster is saying.
        • hanniabu 5y ago
          It can contain passwords to much more and other information
          • hunter2_ 5y ago
            Can you offer some examples, besides financial accounts, of things that a person would prevent others from accessing while alive and grant access upon death? In sifting through the list of things in my password manager, none of them (besides finances) seem to have this quality. Seems like anything that should be seen by family after death could be seen by them before death as well.
            • dylan604 5y ago
              Social Media accounts with private DMs are the first to pop in mind. Cloud storage like Dropbox/iCloud/Drive/etc. Lots of things really if you thing on it for just a minute or so
              • hunter2_ 5y ago
                If someone DM'd me, they were probably expecting me to not share what they said. If I have stuff in cloud storage that could be useful to others, I'll share it now. I'm sure there are use cases, but it's actually very hard for me to think of them, let alone in just a minute or so.
      • hedora 5y ago
        You can reset your lastpass password if you have access to any machine that was recently logged into it.
  • inglor_cz 5y ago
    When I am on a longer vacation and I do not use a certain password, I struggle remembering it. If I were chucked into a prison and let out after several years with no computer use in between, I would likely forget all my passwords in the meantime. No brain damage needed, just disuse.
  • nanomonkey 5y ago
    > Short of brain damage, I don't think that would ever happen. Funny you say that. A year ago I went outside to break up a domestic violence situation. I woke up later face down with a brick next to my head. Due to the concussion I forgot my phone's password and that of my ATM card. It took me six months to remember them, although by then I had replaced both. Shit happens.
  • 42365767567 5y ago
    I actually forgot my master password last year - luckily I had my partner's 1Password set as a recovery. About 3 weeks later I remembered it
  • KronisLV 5y ago
    > Short of brain damage, I don't think that would ever happen. I once forgot my phone's unlock pattern. The very same that i had used for years, daily. I'm not someone that normally has memory problems, but i guess a few synapses just refused to do their job for some reason. I actually had an ex tell it to me, otherwise the phone would be bricked (i tried recalling it for basically 2-3 days). Now i have it and the master password for my password database written down and given to a person that i trust. Kind of a silly and a worrying situation, so it helps to have contingencies for even cases like that. One might worry about Alzheimer's and whatnot after a situation like that, but even healthy "HDDs" occasionally get "bad sectors". Of course, there have also been cases where i forget something that was almost a subconscious memory (e.g. muscle memory) just to remember it a while later. For context: am in the 20-30 age bracket, no other memory problems or a history of memory problems in my family tree.
  • EVa5I7bHFq9mnYK 5y ago
    I forgot mine twice, after having used it for years. And no brain damage yet (at least I think so). Fortunately, in both cases it came back after a few days. Problem with piece of paper - in case of brain damage, I will forget where that piece of paper is hidden ...
• phphphphp 5y ago
  I debate this with myself often. Short of renting a security box and telling people I trust about it, I haven’t come up with a strategy for the master password. At the moment, I’ve resigned myself to the feeling that if I lose my memory, maybe it’ll be the opportunity for a fresh start, and so losing everything is a feature not a bug.
  • jvanderbot 5y ago
    Just send four trusted family members half of the passphrase in a sealed envelope and tell them what it's for. If your family has a lawyer or safe deposit box trusting that instead is a 1000x better option.
    • Spooky23 5y ago
      Lawyer yes, safe deposit hell no. Three reasons: - Banks fubar safe deposit boxes all of the time, in a variety of ways. - Once the bank figures out that you’re dead, it’s sealed without a court order. - As you get older it’s more likely that you’ll screw up payments, lose keys or codes, etc. Also, the attorney will advise your loved ones on what they can do. For example, you need a power of attorney for many things.
      • TedDoesntTalk 5y ago
        Never, ever use a safe deposit box at banks: https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html https://www.nytimes.com/2019/07/19/business/safe-deposit-box...
        • wintermutestwin 5y ago
          >Never, ever Despite the issues, there are still valid uses for a safe deposit box. I live in a highly fire-prone area and keep a backup drive with family photos and documents in a safe deposit box in a local place that won't burn when I do.
          • 5y ago
• girzel 5y ago
  All of my passwords are in the "pass" command line utility, where they're encrypted with gpg. I added my brother's gpg key as an encryption target, and his ssh key onto the sever where the git repo is stored, locked down to the git shell command. In the event of my untimely demise, my wife tells him the url of the git repo.
  • deleted 5y ago
    [deleted]
  • greggsy 5y ago
    I personally wouldn’t go to the extent of using CLI tools, as my next of kins and family members aren’t at all technical. A printout of my 1Password emergency kit in a safe deposit box is probably doable, but then what - 598 passwords to projects on an old git repo on an ancient Synology NAS, or a throwaway account for some random website? There is probably a lot to be said to curate your accounts to assist those sifting through your estate. The ability to pass your information legacy is important, and complicated. The trope of your mother going through their mother’s papers and finding a long lost love letter - or an unfinished manuscript - is equally plausible today. What secrets lurk in your DMs, Messenger and Signal history? Does your draft blog post actually contain some amazingly insightful observation? Maybe your family’s memory of you could be enriched with this information? …maybe not? At the end of (your) day(s), you might take those secrets to your grave, and it’s unlikely that your tombstone will include your GUID, or the Glacier storage URI where your online self will remain until the TOS states otherwise. REST In Blob EDIT: RAM-mento Moar-i(sorry, got carried away.. couldn’t help myself :)
    • dylan604 5y ago
      >What secrets lurk in your DMs, Messenger and Signal history? Does your draft blog post actually contain some amazingly insightful observation? Things that need to stay secret. That's why they are secrets. If my passing means that these things are no longer accessible to anyone ever again? Perfect. Works as intended.
• g3rv4 5y ago
  yeah, I've been thinking a lot about it... Shamir Secret Sharing and splitting the shares in a way that makes sense to me have me piece of mind. I even wrote a trivial console app to let my wife restore my secrets if I were to drop dead tonight.
  • jeffparsons 5y ago
    I was once locked out of some pretty important accounts while traveling overseas. Ever since then, I've been thinking about the importance of being able to "shard" both secrets and authority. If I were to be imprisoned, for example, I might want my lawyer and family to be able to access all of my emails from two years ago up to one week ago. If I were to suddenly die, I would want my family to have full access to all of my accounts, with little hassle. I would like to be able to tell my email provider (through my account settings) that if at least two people out of each of these three groups agree that such-and-such condition has been met, then these people will be granted this sort of access. The process would notify the other members of the groups I defined and have a delay to allow some kind of veto/vote if there is any disagreement. It may be a bit fiddly, but if a standard were defined for how the interaction works from a user's perspective (including steps to make sure you understand the consequences of how you've configured it), at least it could work consistently across all kinds of accounts.
    • g3rv4 5y ago
      here you can see how I'm using Shamir Secret Sharing, I gave clear instructions on how to use the shares and in what circumstances. based on their dynamics, I'm feeling pretty good. I know I have some people there that are tech savvy + some that will take good care of their shares and when they should send those to whom. Implementation is trivial (especially if you find a library) but maybe you can be inspired by my plan https://g3rv4.com/2022/04/a-plan-for-my-secrets https://g3rv4.com/2022/04/a-plan-for-my-secrets
      • bouncycastle 5y ago
        I was wondering, how much do you trust these tools? Cryptography can be extremely tricky to implement. For example, has the tool been checked for side-channel attacks? Has it had any other audits? (On the GitHub page of the library, it says it's no longer maintained)
• eternityforest 5y ago
  My plan is just printed backup recovery codes for things that need 2FA, written master passwords, and normal hard disk backups. The extra hidden part of the plan is that I try to avoid things that aren't tracable to a trusted human help desk. Anything that involves the words "manage your own private key" is a point of failure that needs a lot of care.
  • deleted 5y ago
    [deleted]
  • Tijdreiziger 5y ago
    > The extra hidden part of the plan is that I try to avoid things that aren't tracable to a trusted human help desk. Anything that involves the words "manage your own private key" is a point of failure that needs a lot of care. How do you handle your password manager (assuming you use one)?
• badcarbine 5y ago
  Wrong, we need mainstream, stable quantum encryption to prevent cyber attacks.
• pavel_lishin 5y ago
  I just wrote up instructions for accessing my backups for my wife and friend, and my critical accounts have dead-man switches to give my wife access to everything she would need. Assuming what she needs is access to my email (yes) and gigabyte of photos from my drunk college days (no).
  • colordrops 5y ago
    What are you using for a deadman switch?
    • yeetsfromhellL2 5y ago
      The system I'd trust most is to have 2 attorneys given sealed envelopes with instructions to give them to your wife on your death. One attorney is given an envelope with the passwords to your accounts (or to your password manager) encrypted with a one time pad. The other attorney is given an envelope with the key to it. Each envelope includes instructions to decrypt. If you're giving her a password to a password manager, make sure she has access to the latest password archive and the software to open it. Tedious, yes. But fairly reliable and you don't have to place any trust in your attorneys at all, unless they find out who their counterpart is and start working together (very unlikely). If this system wouldn't work for you, you've probably got bigger problems than having to worry about your wife getting into your email after you die.
      • morganvachon 5y ago
        And for those of us who aren't wealthy enough to have two different attorneys on retainer, giving your spouse the encrypted password store along with the key to a safety deposit box containing the decryption key would have to do. Personally, my wife would wonder why I'm going to so much trouble to keep my passwords secret from her until I die; but then my personal password store is for services we share like banking, and any passwords she doesn't know are benign things like my email addresses and various website logins that wouldn't matter anyway when I die. Of course I also have my work passwords (I'm the IT manager), but my supervisor and the company owner each have a secured store of all of my work passwords as well, plus the master password to access them, in the event something happens to me (or I'm just on vacation for a week and temporarily unreachable when access is needed).
• Pxtl 5y ago
  I wish Google would sell me a letter mail with my Gmail recovery passwords on a nice durable laminated card.
  • dylan604 5y ago
    Or you could just print it up yourself. Why is it G's responsibility and not yours?
    • EVa5I7bHFq9mnYK 5y ago
      Your printer is connected to internet these days and quite probably has backdoors ...
      • emendation 5y ago
        Pretty easy to disconnect a printer from the internet though....
    • Pxtl 5y ago
      I'm not asking them to do it for free I'm like "please let me pay you for this".
• colordrops 5y ago
  For sure. I first focused on setting up a homelab and de-googling my phone and whatnot for privacy reasons, but it's nearly impossible to not be spied on. You can certainly reduce it. In the end I'm still doing this for data sovereignty more than for privacy now, but I don't mind the boost in (imperfect) privacy.
  • Tijdreiziger 5y ago
    Well, you gain privacy from corporations. You have to keep your software up-to-date, though, or you risk losing privacy to hackers.
    • orangepurple 5y ago
      Or you can simply run an application level default-deny firewall and never use a web browser. You don't need to keep your software up-to-date in a homelab.
      • Tijdreiziger 5y ago
        But then you can't access your data outside your local network. That may be acceptable depending on your use case, but at that point it's not a 1-to-1 alternative to cloud services.
        • orangepurple 5y ago
          SSH tunnel with passwords disabled; use ed25519 keys. Or wireguard if you are feeling adventurous
          • Tijdreiziger 5y ago
            So then you need to keep SSH or WireGuard up-to-date (at least in terms of security patches). Also, are you going to SSH in every time you need to access a document from your phone? Again, use-cases differ, but that's not a 1-to-1 alternative to, say, Dropbox.
• deleted 5y ago
  [deleted]
• stuckkeys 5y ago
  I forgot my master password two days after. I thought I had stored it someplace and my guess the phone shaked after typing the master key and it undid the characters. FML moment. Spent a week resetting passwords. I only set passwords once. We use bitwarden. It was a pretty fuckery.
  • neverminder 5y ago
    This is why I have so far avoided password managers: single point of failure. What if you forget your master password. Or worse - what if your master password is stolen?
    • wintermutestwin 5y ago
      ... or what if you are traveling and your phone and laptop are lost or stolen?
      • belval 5y ago
        Your bitwarden password manager is hosted and is only stored encrypted on your phone/laptop. So unless the thief knows your master password you should be fine.
        • wintermutestwin 5y ago
          I understand that the thief won't have access to my accounts, but now I don't either - correct?
          • fauigerzigerk 5y ago
            It depends on whether you have access to the second factor. I have Authy installed on two phones for that reason.
          • belval 5y ago
            You would still have access to your accounts as the credentials are hosted by BitWarden or by yourself (on a personal server for example).