Hacker News Reader

Comment by ubermonkey | Hacker News Reader

I have.

I had most of this done already, but about a year ago a friend of mine -- very healthy! younger than me! -- literally dropped dead. It was a bolt from the blue, for sure, and the trouble that followed for his widow was a wake-up call.

For some reason, he and his wife weren't on a "family" plan with Apple, which meant, from Apple's POV, they were just two customers, and lawyer letters and whatnot would be required to get her access to even his pictures on the phone.

Apple NOW has a feature that allows you to nominate a "digital legacy contact" for your Apple data. If you're on iOS, I RECOMMEND IN THE STRONGEST POSSIBLE TERMS THAT YOU CONFIGURE THIS IMMEDIATELY.

https://support.apple.com/en-us/HT208510

As for the rest of my digital life, everything is in a password manager, and my wife understands that the master password for said vault is in the safe.

View on HN

Google has Inactive Account Manager, which is a dead man's switch for your account. Everyone should set that up too. https://support.google.com/accounts/answer/3036546?hl=en

Anecdote: I'm the account manager for most family members. One day my sister was angry with me, removed me as the account manager, and some months later locked herself out of her account after having trashed her phone and forgot her password.

She sounds like a rational actor.

I like that they have this, it means if I ever go missing unexpectedly that there'll be someone who can access my last known location, and access to social media comms to understand why.

I just tried to set that up and got a page that says it’s not available for my account.

You must already be deceased to use this service.

Probably not available for business & education accounts. Maybe not available in all countries?

Same here. In fact, I took it one step further and drafted a document that outlines all the important business contacts I have the she would need to contact in case of my death. To liquidate assets, and/or help with keeping the businesses I have running. Online services, hosting providers, etc.

That's a good idea.

Man, that's probably the smart way to go.. I just told my wife to take my half-assedly secured computer to one of my tech friends to break into it

I've done the same with taking the password manager approach and putting the master password in the safe. I've also place a "death envelope" in there that outlines who would need to be notified from my employer and other important contacts. We also have "safe opening" class every so often.

This doesn't give the contact access to your keychain. Only messages, files, photos, etc. In order for them to inherit things like cloud passwords you'll need to set that up yourself somehow.

Will your paper in the safe survive in the case of a house fire that kills you?

If it's a fire-rated safe, probably. Good point about paper, though, electronic media likely wouldn't survive. I'm going to update my records--the main stuff goes in a cloud account, but paper in the safe with the credentials.

My neighborhood burned up a couple years ago, and safes were fairly worthless, fire-rated or not. Papers were ash, precious metals were all melted. Many safes had shattered, or were so degraded they could be broken with a kick. Just a warning... I'm sure some safes can withstand intense housefires, but it seems like most claiming so, can't.

Now that I read it again, the comment was about storing the master password in a safe, in which case, you could stamp it into a metal plate or some other solid that has a high enough melting point. Steel seems like a good choice of melting temperature, with titanium even better. Or try tungsten, for a much higher melting point.

How do you protect against government accessing your safe, getting your master password and accessing all your digital files. If I am not mistaken, Fifth Amendment protects one from incriminating themselves by giving up their own password, but in your case they just need to confiscate and open your safe.

If the feds want your data and are willing to confiscate your safe to get it, they can probably get your data without confiscating your safe.

> How do you protect against government

In general; you don't. If the gov. wants to make you do something, you're going to have to do it. In many western countries, that's only a vague threat, an many others it's a lot more real.

Theoretically, you could have two components to the password: something long and random that is written down, and something easily remembered and personal. A special moment, a place, an anniversary only the two of you would know, etc.

What benefit does the long random part provide?

Bruteforce protection.

It prevents it being guessed. The memorable part protects against someone finding the written down/recorded random portion and using it since they don't have the remembered part, but the remembered part on it's own is somewhat vulnerable to guess work

I don't.

If one has something going on such that state-level actors might want nefarious / adversarial access, well, one should be taking MUCH MORE SERIOUS STEPS about personal digital security.

Your "regular everyday normal mfer" (as the song apparently incessantly looped on Instagram goes) has no such enemies. My personal digital opsec is designed to keep me and mine safe from likely threats, and the threats I face are pretty banal -- brute force attacks, mostly. I am 100% unconcerned about governmental intrusion into my safe to gain access to, e.g., my online banking passwords.

You do realize state actors include the IRS, the FBI on a fishing expedition for a crime that occurred near your house, being framed for a crime because you look similar, false DNA matches, etc, right? All of these things are non-zero, and significantly above non-zero that everyone and their grandmother should consider it. Unfortunately, pandora's box opened with Snowden. We are all targets. The only difference is what degree of a target you've made yourself. If you work in tech, you're already high on a priority target list somewhere.

By the time the FBI gets a warrant and takes my safe with all my secrets, it's too late. Maybe I'm naive but I don't have time to live my life with your degree of paranoia. Good luck to you in your endeavours to avoid anyone knowing anything about your life.

It's not about preventing people from knowing anything about my life. It's about control and threat surface. You can do these things without thinking after a little practice. I would like to present the version of myself I want the public to know about and have full control over that. Incursions into my privacy violate that idea.

It's not paranoia. That would imply they aren't out to get you. They are. Leave the government out of it for a second. If someone's phone is stolen it's very likely their entire identity, a majority of their secrets, documents like medical ID cards, credit cards, etc have been compromised. This is akin to "getting a warrant to a safe" (which in reality is just court-ordered theft) and it will completely destroy a person. In the context of the discussion if you were able to break into a dead person's phone you could very likely build a complete picture of their life. Perhaps one they weren't interested in you knowing about.

I'd prefer to avoid those situations. First, by not making myself a target, and second by protecting any and all data I have the best I can. I rarely think about it but I know if my phone is stolen, my computers are taken, or I get caught up in a fishing expedition the threat surface is extremely limited (provided the information isn't beaten out of me).

You have chosen to have a different risk tolerance than the person you’re replying to. They explained their threat model, you disagree. That doesn’t make you right or them wrong.

It’s simultaneously true that for your model they’re being naive and for theirs you’re being paranoid. That’s fine.

Well said, good sir!

Oh, for fuck's sake.

I'm pretty sure that song is a blatant ripoff of "Regular Everyday Normal Guy" which predates it by about a decade. https://www.youtube.com/watch?v=5PsnxDQvQpw

I googled the lyric when posted because I only have it from the contextless world of Instagram reels, and I have a fetish for accuracy.

It was indeed from Jon Lajoie, but not the song you link. It looks like he did a followup track called "Everyday Normal Guy 2" which includes exactly the loop you hear (with "motherfucker" and not "guy" in the refrain) everywhere on social media right now.

https://www.youtube.com/watch?v=GmG4X9PGOXs

TIL, thanks! Takes me back

https://xkcd.com/538/

If they get a warrant from a court, they can open the safe.

As the question is about granting access to accounts after death, it seems an odd worry. The government is also likely to get access to your data from your Google, Facebook, etc. If you have a server in the cloud, they can probably go to your hosting provider to get physical access.

So unless you have data in secret offshore servers in countries that won't cooperate with the US government, then a safe is not your weakest link.

My question was regarding about having secret to your password manager in a safe, which I agree think is still on-point with the topic for "Have you set up a procedure to disclose your passwords in case of death?".

Storing secret to password manager that can be easily accessed by government and state actors negates all the trouble that password managers went through ensuring no one besides you can access it. I believe every good password manager encrypts data in a manner so that the provider itself can't decrypt it if government tries to get access to it.

Don’t keep anything behind that password that the government doesn’t already have access to!

Government already has access to banking and phone records, most online accounts and data from Apple, MS and Google.

I prefer to think of the NSA as my cloud backup provider of last resort, paid for by my (overly abundant) tax dollars and responsive to a FOIA request ;)

I think for 99%+ of people that’s not much of a concern, but if it is for you, what’d be wrong with burying it under a rock in the yard, or any of the 100+ sneaky ways one could secret a envelope somewhere for safe keeping (there is a slip of paper in the copy of Moby Dick at Bob’s house in the library, and if it’s not there, there is backup one at uncle Jim’s in the NE ceiling tile of the ground floor guest bathroom).

I’m sure others have much better ideas…

I think your statement about 99% of people it not being concern is true at any given snapshot of time, but not true across the lifetime of those 99% people. Case in point: Harvard student gets denied entry because of his friends' social media posts which were discovered upon searching his phone [https://techcrunch.com/2019/09/02/denied-entry-united-states...]. If you were to ask him, he would say he is part of 99% and has nothing to hide or be concerned about, and is probably true for most of his life, besides that period where his friend posted something on whatsapp and his phone being searched.

Wow this was quite possibly the most helpful Hacker News comment to date.

Reply on news.ycombinator.com