Hacker News Reader

Comment by tpetry | Hacker News Reader

Sure, you don't have to stop at distributing just once copy…

Even then - this is a fairly ugly solution. You're dependent on an external entity to be responsible with your stuff in the case of an emergency.

I love my friends and family, but I'm not sure I'd trust them to keep a random file/paper for years on end "just in case" and still be able to find it when I need it.

Personally - I went with the "extra yubikey in a safe deposit box" approach, and it still feels super shitty.

I'm not at all a fan of "code is law".

It doesn't even scale. This assumes you're the only one with PDFs to share. What if you have siblings and other relatives, and all of them are tech-savvy -- if they aren't now, in the future they will be -- and want to store the PDFs with your parents.

What, are your parents going to be running a PDF storage service, classified by person? That's too much to ask of them (for most parents).

All these "rebutals" to the pdf approach sound like those infomercial TV ads where people have trouble doing normal day to day things.

Like... mass enail the PDF to several members of the family and be done with it. Can it happen that 5 people at once lose their email access? Sure, but the probability is minuscule.

The comment I was replying to was about physical paper copies, not emails.

Distributing digital copies of your password store to your friends and relatives could maybe work. Be sure you're using a really strong password (that you can also remember by heart), because you cannot trust each friend will store the file responsibly away from prying eyes.

Remember the scenario:

- You lost access to your recovery codes and any handwritten notes, so you better remember the master password by heart.

- But this master password better be really strong, because each of your N friends you distributed your files to is a potential leak to hackers and thieves.

- (Tangentially related: remember you have no authenticator either, so your password store better include recovery codes, otherwise without 2FA you're screwed)

> What, are your parents going to be running a PDF storage service, classified by person?

I mean, it's a piece of paper. They could write the name of the person on the paper, keep them alphabetized, and store and search through hundreds of them easily (let's assume they're rabbits with hundreds of children). There may be all sorts of problems with this approach but I don't think burdening parents with paper storage is one of them.

Edit: of course, if they were rabbits I wouldn't trust them with paper storage. Rabbits are notorious chewers.

I dunno. I've already burdened my parents with plenty of things, and so have my siblings. I don't know that I want to make them responsible for storing random bits of paper they may or may not forget about.

> I'm not at all a fan of "code is law".

You can always not use two factor auth.

And I don't in certain cases (even when I'd like to).

But it's getting increasingly hard to opt out of 2fa on some services.

But not using 2FA comes with its own set of problems. The kind of problems 2FA was introduced to mitigate.

I don't know how you or your friends/parents store important documents but everyone in my bubble has multiple document binders with critical paperwork to keep. Adding a single paper to them is no problem, and the paper is not lost. Stuff is never removed from those binders, just new ones added.

Back when my parents were still in the land of the living, I would've been entirely comfortable believing that the odds of them failing at that would've been low enough that (odds of that failing * odds of my needing that data) would've been stupidly low - low enough I'd've accepted the risk and stopped worrying about it on the basis the likelihood of a problem at that point was significantly lower than many other at least as awful problems and I should focus on mitigating those instead.

And what if someone dies? We'd need something that would do periodic health checks. Preferrably during off-peak hours..

Reply on news.ycombinator.com