Comment by bronco21016 | Hacker News Reader

Comment by bronco21016 | Hacker News Reader

I’ve given a lot of thought to this problem lately after becoming a parent. However, I just can’t picture trusting this to a third party. Ideally I’d store my master password to my password manager and give instructions on what accounts exist and what to do with them. By storing this on someone else’s server I’m at risk of that data being leaked which is effectively the ‘keys to the kingdom’. You can talk about encryption all you want but without knowing what’s actually happening with that extremely sensitive data behind the scenes I cannot trust your product. Perhaps a Bitwarden style model where the source is provided could be a solution? Because Bitwarden is open source, self-host able, and audited I can have some degree of comfort that my data is actually encrypted client side and stored safely.

Speaking of the problem space, what non-tech techniques do people use for this scenario? The best I’ve been able to come up with is storing the information in two safes and leaving instructions on how to open the safe in a will or with trusted persons. Other thoughts?

Although I haven't personally set this up, my plan has been to at some point:

* Put important documents and passwords in an encrypted archive or true/veracrypt container.

* Distribute the archive to relevant parties via physical media (e.g. USB stick), possibly put a public version online on somewhat reliable free hosting.

* Store the password to the archive (without any indication as to the purpose of the password) on a service such as the one in the article or an alternative, e.g. Dead Man's Switch

Because of the physical distribution of the archive, it makes it hard to change the secrets in the archive - but other than that it seems solid enough...

[1] https://www.deadmansswitch.net/

Interesting idea. I suppose it’s relatively low risk that the secret would be stolen and then connected with the encrypted archive. Thanks!

I created https://www.deadmantracker.com and am implementing the reverse of this but your solution is a good alternative that I might support too.

The way I saw it working was: * Encrypt docs into a compressed archive

* Upload encrypted docs to service

* Distribute password for unencryption using something not build into the service (tell them via Signal, or Protonmail, or a piece of paper, or word of mouth)

* Link for encrypted archive only becomes available once the dead mans switch is triggered

In the same way a password could be uploaded and only released when the switch is triggered. A service just can't hold both parts.

I bet someone makes a product with this someday https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing.

You could in theory have a digital safe that you yourself can open with one key, and a quorum set of 2 keys that require both. You distribute 1/2 combination keys to your kids and keep one yourself. When you die your 1/2 key is passed to the kids who can now open the data. The keys themselves are useless without the other keys so anyone in the chain of custody of the key until it reaches your kids wouldn't be able to open the data. No one would have to have your singular key.

According to the post below they exist now. I'm hoping for recommendations!

https://news.ycombinator.com/item?id=21345210

You can play around with Shamir's secret sharing here: http://passguardian.com/

I've wrote https://bs.parity.io/#/ exactly for this; it also tries to avoid the most obvious opsec mistakes, like trusting your printer too much =)

BananaSplit is of very experimental quality, it hasn't been battle-tested and independently reviewed yet. But at least it's there, it's FOSS, and I encourage you inspecting the code, contributing to it, or re-hosting the HTML.

I hope you’re kidding about the two safes thing. Either hire an attorney for this purpose or accept that your family will have little to no recourse for challenging claims from individuals, businesses and family members who claim rightful ownership of parts of your estate. You can buy all the safes you want but they won’t hold up in court.

Even if you want your spouse to be your executor you need an attorney to receive your power of attorney immediately so that they can make him/her the executor. Without an attorney and notarized documents, if someone shows up with a piece of paper that says they get everything and it has your signature then their claim is just as valid as your spouse’s.

>I hope you’re kidding about the two safes thing. Either hire an attorney for this purpose or accept that your family will have little to no recourse for challenging claims

Silicon Valley: who needs accountants or lawyers?

Also Silicon Valley: how many safes do I need to ensure my spouse can access my KeePass database?

I think we’re discussing separate things.

The idea behind the safes is to store instructions for accessing a password database so loved ones would have access to the various online accounts. Think utility bills, banking, email, etc.

If the system for providing a third party (spouse, children, etc) access to online accounts is broken then surely you can see all the ways that ones life could be turned upside down.

I’m well aware that I also need an attorney and necessary legal documents for establishing power of attorney and executor of the estate. Would an attorney be an appropriate person to share the information about unlocking my online life with? I know they’re bound by various ethical and legal frameworks but it still doesn’t stop people from doing crazy things.

I like 1Passwords auth for this. There's a long key you need once (this stays in a lockbox), and a master password you need every sign in (safety deposit box with no information about what it is).

I feel like a bank's safe deposit box system coupled with an estate planning service is the traditional approach to this.

I store my information in a safe and happen to be extremely close friends with a few locksmiths.

Reply on news.ycombinator.com