Hacker News Reader

Comment by alex_duf | Hacker News Reader

I can see why the opposite might be valid, if you recently lost someone the last thing you want is argue with Facebook that yes, that loved one is indeed dead.

Probably needs some better rules but that part needs to be as painless as possible

View on HN

I can offer Facebook two choices to verify death if a third party alleges it. Either provide the death certificate or the name of the funeral home.

If Facebook was smart they'd make it super simple for the funeral directors to provide this information directly to them. I lost my dad late last year and had to answer a number of questions for the funeral director.

All the funeral director would have to do is ask if the deceased had any social media accounts and do you want me to contact them on your behalf?

> All the funeral director would have to do is ask if the deceased had any social media accounts and do you want me to contact them on your behalf?

This would make a great plot for a novel, a disgruntled funeral director starts "killing" people digitally by marking various accounts permanently deactivated after death. And thanks to advances in genetic engineering, even showing up in person isn't enough to prove they're who they claim to be anymore, so they can't drive, work, buy anything, or communicate with anyone.

I dig this, and want to have a crack at a short story for it. Do you mind?

LastPass seems to have a decent system (thankfully I haven't needed to test it yet):

1) I set an "emergency heir" contact

2) They can request access at any time

3) I'm sent an email notifying me of the request

4) If I don't deny the request in X amount of time (custom, I think), they are granted complete access to my account

Granted there's a potential for abuse; but that's somewhat mitigated by only allowing 1-2 people to make the request and if someone already has access to my email they can cause all sorts of other trouble without having me declared digitally dead. It shouldn't be hard for Facebook to implement something similar.

That's exploitable. Hack the heirs email, wait until you are on a holiday, hit them with a request for access. You won't respond in time because you're climbing Mount Everest or diving in the Marianas Trench (the heir might really be a heir in either of those scenarios) and then access will be granted.

All systems are exploitable given enough time and effort. At that point they may as well just"hack" the actual account owners email.

In cases like that you'd set set the time window to be longer than you expect to be off the grid.

Granted it is a slightly larger attack surface but it relies on 1) knowing the heir (wife, parent, child, friend) 2) gaining access to their email 3) Relying on the original owner having an inadequate time window 4) the owner going somewhere they are completely cut off from the world. It could happen, but that's a vanishingly small opportunity.

You’re going up Everest? Cool, change X to 40 days.

No, you'd have to hack the heir's LastPass account.

Also, as others have mentioned (including the parent), the length of time is customizable as well.

Or you could just skip the middle man and hack the target's last pass account.

Anything can be exploited if the criteria for exploiting it is somehow breaking into an arbitrarily secured network/facility.

I have mine set to 30 days (maximum).

Honestly, If I'm in a situation where I'm without internet for 30 days its involuntary and I'm fine with releasing access.

Why not err on the side of caution and leave the profile alone until someone, with adequate documentation and at a time of their choosing, contacts FB about converting or deleting the profile? I don't think leaving it up does any harm.

I had a friend die in sufficiently unfortunate circumstances to attract media attention. It was definitely a good thing that Facebook deactivated his account very quickly upon request (I doubt the person who asked for it to be deactivated had access to the death certificate at the time) before journalists used it as a source of photographs and people to ask for quotes.

For that case, though, there is a very valid way to verify the status of the deceased: The death certificate.

Indeed, at least in the US, it’s expected that you’ll need several copies of the death certificate to handle bank accounts, etc. I doesn’t seem like a burdensome requirement to ask for one.

Years ago I took it upon myself to cancel a record of the month club membership belonging to a work colleague who died suddenly. They would not do a thing without a copy of the death certificate, so I had to tell them that all I could do then was recommend they keep sending the records and they'd have to eventually try suing him for payment.

Why? Why is the priority to shut down an account? That should not be what is important.

Reply on news.ycombinator.com