371

I'm the digital guru in my household. My wife is good with email and forum websites, but she trusts me with all our important digital stuff — online banking and other things that require passwords; also family photos and the plethora of other digital things in a modern home. We discuss relevant actions but it's always me that executes them.

If I were suddenly incapacitated, then my wife would be thoroughly stranded: she would have no idea what digital stuff is where on our computer, how to access it, what online accounts we have, and what their login credentials are. It would also leave my many public appearances (personal websites, email accounts, social networks, etc.) unresolved.

To complicate things, I'm one of those people who don't use the same password everywhere; I use a mix of SuperGenPass and LastPass, and also two-factor authentication whenever possible. I don't have much hope that she would find her way through a written explanation of all that in a stressful situation.

I could just tell her that she should ask my tech-savvy twin brother and then entrust him with my LastPass master passphrase. I feel that would have a good chance of success, but it's inelegant and leaves my wife without control of the information.

How can I ensure that my wife has access to my digital remains?

Update:
A tremendous thank you for all the great contributions. I've learned a lot! Now I just need to decide :-)

13
  • 17
    Last Pass has the ability to setup a single password that will allow access to your account. I would setup a couple of these. This will give her the ability to change your password once she has access. Give her the basic tools and the basic knowlege and she should be fine, of course, your twin can always feel in the gaps.
    – Ramhound
    Dec 4, 2012 at 12:45
  • 87
    "feel in the gaps"? whoa wait a sec, we only want the twin to access the digital stuff
    – cambraca
    Dec 4, 2012 at 16:58
  • 13
    @drescherjm Odd that many people have had their wives ask the same question just last night. I wonder if there was some TV special on it that we all missed ;)
    – Nate
    Dec 4, 2012 at 21:46
  • 8
    "I don't have much hope that she would find her way through a written explanation of all that in a stressful situation." That's a vital aspect of the problem. Whichever technical solution you adopt, I don't think it is advisable to rely on written instructions after you become unavailable. Any robust solution needs to involve her periodically practising accessing these sites. Also, maybe should have her own LastPass account, and access could be shared that way (helpdesk.lastpass.com/password-manager-basics/sharing)
    – Ergwun
    Dec 5, 2012 at 3:58
  • 8
    @PulakAgrawal: I have no idea what you just said, but my brother lives in another country, 1500km from here. It'll take a massive quake to "get" both of us and then I think passwords have become irrelevant. Dec 5, 2012 at 10:35

12 Answers 12

66

We have actually covered this in some detail already on Security SE

These posts go into detail about what you can and can't share - there may be some legal/contractual ramifications if you share logins for banking etc.

So there are some simple technical solutions (Keepass/DropBox etc) and some procedural ones (password for your master password file stored in an envelope with a solicitor or notary)

This may sound harsh, but while you may trust your brother - it is often best to avoid placing them in a position where they have the opportunity to do something malicious, as his circumstances may change in such a way that forces him to. (as an example - gets accidentally in debt to someone with organised crime links - who blackmails him into payment on threat of injury to family) - much better to trust a lawyer, who has a professional and ethical code of conduct which will (hopefully) act as an additional barrier to misconduct.

4
  • 1
    Just like Clement's great answer, this one is excellent and I am choosing this as my accepted answer because it offers several choices and covers various aspects of my problem. Dec 13, 2012 at 20:30
  • 8
    So a lawyer can't get accidentally in debt to someone with organised crime links - who blackmails him into payment on threat of injury to his family? Also, doesn't the notion that lawyers are more trustworthy than brothers seem a wee bit wrong to you?
    – Seun Osewa
    Jan 9, 2014 at 9:59
  • Why should a brother be seen as more trustworthy? We agree all humans may have greed, but a brother doesn't have a written code of ethics/conduct which has as a punishment the threat of being disbarred - ie removing their ability to work in their chosen industry.
    – Rory Alsop
    Jan 9, 2014 at 13:41
  • @Seun - Additionally, a family member might suffer a conflict of interest between the confidential information and personal interests. Jul 13, 2015 at 17:59
71

There are a number of suggestions provided in Jeff Moser's post related to this.

A Proposed Solution

Let’s borrow an ancient yet incredibly useful idea: if it’s really important to get your facts right about something, be sure to have at least two or three witnesses. This is especially true concerning matters of life and death but it also comes up when protecting really valuable things.

By the 20th century, this “two-man rule” was implemented in hardware to protect nuclear missiles from being launched by a lone rogue person without proper authorization. The main vault at Fort Knox is locked by multiple combinations such that no single person is entrusted with all of them. On the Internet, the master key for protecting the new secure domain name system (DNSSEC) is split between among 7 people from 6 different countries such that at least 5 people are needed to reconstruct it in the event of an Internet catastrophe.

If this idea is good enough for protecting nuclear weapons, the Fort Knox vault, and one of the most critical security aspects on the Internet, it’s probably good enough for your password list. Besides, it can make a somewhat uncomfortable process a little more fun.

Let’s start with a simple example. Let’s say that your master password is “[email protected]”. You could just write it out on a piece of paper and then use scissors to cut it up. This would work if you wanted to split it among 2 people, but it has some notable downsides:

It doesn’t work if you want redundancy (i.e. any 2 of 3 people being able to reconstruct it) Each piece would tell you something about the password and thus has value on its own. Ideally, we’d like the pieces to be worthless unless a threshold of people came together. It doesn’t really work for more complicated scenarios like requiring 5 of 7 people. Fortunately, some clever math can fix these issues and give you this ability for free. I created a program called SecretSplitter to automate all of this to hopefully make the whole process painless.

Here's the link to the SecretSplitter software he created.

You might also be interested in the Dead Man's Switch website.

You never know when you might be hit by a bus. Are you prepared for it? Maybe you want to pass on important information, notify some online acquaintances or apologize to an old friend. Enter DeadMansSwitch.org.

The service is simple. Type an email and optionally attach a few files. Every few days we will send you an email with a link that verifies you are still alive. If something does happen we will send your emails 30 days after we last heard from you. Is 30 days too long? No problem, someone close to you can use an emergency release code to dispatch the emails early.

Your emails and files are encrypted on the server using AES-256 encryption to help protect your data.

7
  • 15
    "Your emails and files are encrypted on the server using AES-256 encryption to help protect your data." - The only way I'd trust this with my master password list is if it were encrypted client-side, like LastPass. From the sounds of it, it is not. Dec 4, 2012 at 18:24
  • 21
    Doesn't stop you from uploading an encrypted database.
    – Collin
    Dec 4, 2012 at 19:45
  • 1
    and give the key to whoever you want to have access in the event of your demise.
    – Nick T
    Dec 4, 2012 at 20:46
  • 32
    The problem with DeadMansSwitch is that you're relying on a third-party company/individual to keep the servers paid for and operational long enough for you to meet your untimely doom -- it's entirely out of your control. Conversely, something as simple as printing out the important info, storing it in a fireproof/floodproof lockbox, and giving your SO the key is 100% within your control and you need only rely on your SO not losing the key for it to be effective. Dec 4, 2012 at 20:54
  • 2
    @SevaTitov, you're missing "to keep the servers paid for and operational long enough" part. If DMS suddenly go down, your ancestors will be left with useless pile of bytes without any means to decrypt it. Dec 5, 2012 at 13:38
49

The most straightforward way ? Export all urls with the corresponding passwords, together with a short manual where applicable, to print them out and pass to your wife.
If what you said (adopting your ways of digital security not being an option), I can't see any other, more practical way of handing that stuff over.

Either put the printouts in a safe, or integrate them in your will. Obviously, putting those virtual things on paper presents you with a huge security risk.

Edit: updated my answer for future references. As suggested in the comments, there is a possibility to bypass the security risk mentioned above, by using LastPass's one-time password (OTP) service. This way, you only have to keep a single-use master password on file.

7
  • 3
    +1 for a simple solution, although using paper makes the information static. The security risk is much reduced if it's stored safely (safe, lawyer). I'd prefer something that stays up-to-date. Dec 4, 2012 at 12:41
  • 2
    @TorbenGundtofte-Bruun - Last Pass supports all your passwords being exported. It also supports single use passwords. Just create a document that explains how to export all your current passwords upon being hit by a bus. The hosts of Security Now often talk about stuff like this, take a look through some of their shows, you might be able to get a couple ideas.
    – Ramhound
    Dec 4, 2012 at 12:47
  • 1
    Instructions for LastPass one-time passwords are here: helpdesk.lastpass.com/security-options/one-time-passwords Dec 4, 2012 at 13:24
  • 2
    If you keep them at home, or anywhere multiple people have access, I'd suggest storing any hard copy passwords in a tamper evident manor so that you can potentially detect anyone snooping. A low tech solution would be inside an envelope with your signature along the seem. While it's possible for someone to forge your signature or open and reseal the envelope without their having done so being obvious it will shut down any casual snooping. Dec 4, 2012 at 16:43
  • 1
    what about the passwords which I have to change every 30..x days. Do I keep giving her printouts ? And what about theft in my house or wherever it is kept even if its a safe in a bank (I have seen too many movies and 24).. point being we are eventually going towards a single point of failure. Dec 5, 2012 at 4:30
37

Use KeePass and store all your passwords in a KeePass file, encrypting it with a master password. KeePass encrypts the contents of the file with the master password you use.

If you need file mobility, you can put the KeePass file on DropBox (or Google Drive, etc), so that way the file is on all the machines you sync up with your favorite "web drive" tool.

Give this password to your wife, and tell her where she can find the KeePass file. Problem solved (hopefully).

The really nice thing about KeePass is that its truly cross-platform: works on Windows, Mac, Linux, iOS and Android.

UPDATE: in addition to being a file-based and "offline" solution to LastPass, KeePass also has a rich set of security and other features listed here. Here are some that stand out to me in relation to this specific question:

  • Strong Security
  • Multiple User Keys
  • Portable and No Installation Required, Accessibility
  • Export To TXT, HTML, XML and CSV Files
  • Import From Many File Formats
  • Support of Password Groups
  • Auto-Type, Global Auto-Type Hot Key and Drag&Drop
  • Intuitive and Secure Clipboard Handling
  • Searching and Sorting
  • Open Source!
6
  • 4
    This is my first thought. Use keepass, in a dropbox (or similar) and teach her how to use it. You keep it up to date, she has access to everything needed (Website addresses, logins, passwords, answers to secret questions kept in notes, important documents added as file attachments, etc).
    – WernerCD
    Dec 4, 2012 at 17:50
  • 2
    He already stated he's using LastPass, so this answer doesn't really give him anything new... Dec 4, 2012 at 18:27
  • 6
    I would argue that LastPass and KeePass are slightly different solutions - also KeePass (IMHO) has a much richer categorization options. But that's just my opinion, I'm open.
    – Suman
    Dec 4, 2012 at 18:31
  • Here's a LastPass/KeePass comparison, and 2 more; and cloudless LastPass alternatives; and Lifehacker article. (I like the cloud; it helps with automatic synchronization.) Dec 5, 2012 at 8:38
  • Keepass is an app that I use all the time, synchronize it across all my devices. And if something happens to me, one USB key (that I keep in my personal bed table drawer) has all the instructions to access it. Dec 5, 2012 at 12:06
23

If you are able to login to each others email accounts, that solves most of the problems because that is how most online services allow users to change passwords.

If you want to get a little more fancy and if you use gmail, there are ways to generate a list of "one-time passwords". Just print out a list of these one time passwords and give it your spouse.

For the things that really, really matter like bank accounts, there are ways for a spouse to get control of these things. Yes, it might involve a phone call or a visit and some forms might need to be filled out, but its not like the spouse will be locked out of the account.

Generally speaking, password-based authentication is messed up and will be that way for quite some time. The ultimate answer to this will be some form of very robust third party authentication (not Facebook!), that can be used to verify identity/relationships for any and all purposes. Unfortunately, we are probably a decade or more away from that.

Right now, however, I disagree that any elaborate software-based solutions are the way to go to solve this problem. The best thing you can do is to keep things simple, and make sure that each of you knows WHAT assets you own. Getting control of them is not that hard if the spouse knows what they are.

0
15

Here's what I did: write your LastPass master password down on a piece of paper, and put it in the safe or your bank's safe-deposit box.

Alternatively, have your wife create a LastPass account, and do a secure-share of your important items with her.

You can of course do both (I did). In any case, make sure to leave a note (in your will, or your safe, etc.) explaining/reminding her how to find the password(s) and what to do with it.

2
  • ... and also write down a tech-savvy trusted third person she can turn to for assistance! Dec 5, 2012 at 8:25
  • A safe deposit box can be sealed by the court for weeks after a person dies. Dec 6, 2012 at 16:12
9

That's a lot of info to pass to her. Specially because it's not only passwords, but also where the files are located. Some online, some locally.

But, no matter how easy you try to make this, it will still be a lot for her to deal with.

So I'd separate into three categories:

  1. Things she can easily retrieve herself
  2. Important stuff and stuff she'll need sooner
  3. Not so important stuff that will take a while for her to need

Things she can easily retrieve

This depends on where you are, but there's probably stuff that she can easily retrieve herself. I'm guessing online banking is one of them. She'll probably need to go to the bank if you pass away no matter what, right?

Important stuff

I'd bet there are a few key accounts. I'd focus on those.

  • Print a page with the "IMPORTANT STUFF" on the header.
  • Put the users/passwords for the key accounts here.
  • Also print the location of the main files on your computer.

Since those should be few, update it every time you change it. On the same page, also put the location of the main files.

Not so important stuff

Let the password manager handle the passwords.

  • Print a page with "OTHER STUFF"
  • On this page put the master password for the password manager.
  • Also put in here the location of the other files.

How to proceed

Print it all together and leave somewhere where only you two are going be able to find. The first page should be the "IMPORTANT STUFF".

Let her come to the "other stuff" in her own time. Since it's not important, it may be longer down the road and it'll be easier for her to deal with the master passwords. Tell her to ask for your brother's help if needed.

You also have to account for what she think it's important. She may not consider your personal website that important. So you may have a third page with stuff that only your brother can help, like updating the site.

1
  • I like the idea of sorting by importance! Only the top items really need to be covered; that might simplify the solution because things like a list of bank accounts and access codes doesn't change very often. Dec 5, 2012 at 8:23
7

A similar problem is adressed by Cory Doctorow in Context.

I’d split the passphrase in two, and give half of it to my wife, and the other half to my parents’ lawyer in Toronto. The lawyer is out of reach of a British court order, and my wife’s half of the passphrase is useless without the lawyer’s half (and she’s out of reach of a Canadian court order). If a situation arises that demands that my lawyer get his half to my wife, he can dictate it over the phone, or encrypt it with her public key and email it to her, or just fly to London and give it to her.

As simple as this solution is, it leaves a few loose ends: first, what does my wife do to safeguard her half of the key should she perish with me? The answer is to entrust it to a second attorney in the UK (I can return the favour by sending her key to my lawyer in Toronto). Next, how do I transmit the key to the lawyer? I’ve opted for a written sheet of instructions, including the key, that I will print on my next visit to Canada and physically deliver to the lawyer.

When I'm Dead, How Will My Loved Ones Break My Passwords

Of course, if you write your password in this kind of file (or partition), you have to keep it up to date but it's not a problem: the encryption key is fixed but not the data.

1
  • 2
    This is a fantastic plain-English treatment of the problem, as well as a reasonably elegant solution -- although it suggests relying on two parties that are in separate legal jurisdictions. So: don't trust two US residents, or two EU residents, but one of each is okay - if you're lucky to have trustworthy contacts there! Dec 13, 2012 at 20:26
3

Place a file, encrypted if you wish, on your system containing all your user IDs and passwords. Create a separate account that has access to this file. (Use a separate account so you don't need to worry about the "cleaning lady" accessing the file through your wife's standard account.) Write down the account name and password (and the encryption key, if there is one) along with other access info, seal in an envelope, and have her place it somewhere secure.

4
  • 2
    This makes the contents of the file static not helpful if you have lots of passwords which are update yearly and/or monthly.
    – Ramhound
    Dec 4, 2012 at 14:34
  • ... and it doesn't include credentials for accounts that you created since you made that file. Dec 4, 2012 at 14:44
  • @Ramhound Nothing says this is "static". Account name and password of the file may be static, nothing says the file has to be. If I make an account on Google, create a google doc and put the username/password in a lockbox to be opened on death - NOTHING says that I can't log in and update said Google Doc.
    – WernerCD
    Dec 4, 2012 at 17:53
  • 1
    He already stated he's using LastPass, so this answer doesn't really give him anything new... Dec 4, 2012 at 18:29
3

While I like lastpass and use keepass at work, I think this is a perfect application for an IronKey.

  1. Buy an IronKey.
  2. Assign it a password that both you and your wife know.
  3. Put links and passwords to web sites on the ironkey in a text file.
  4. Lock it up in a fire proof safe.

This won't solve any issues you will have if you use 2-factor fobs, but you can include recover instructions in the text file.

You will derive two benifits from having a physical device;

  1. Your wife will know exactly what she needs and where it is.
  2. It will be slightly more secure becasue it is "offline". (And if you keep it locked up, more secure than a laptop you may carry around.)

But this is really subjective, and it depends on the best process for you and your wife. I would suggest making it as easy for her as possible while absolutly minimzing the risk of accidental or malcious disclosure.

4
  • 3
    This makes the contents of the file static; not helpful if you have lots of passwords which are update yearly and/or monthly, and new accounts must be added manually. Dec 5, 2012 at 8:21
  • 1
    I agree with Torben; this looks more like a suitable option to store a master password than for general PW storage. Dec 5, 2012 at 16:52
  • What is your definition of a dynamic file? It's no more static than any other file on any other disk. Is updating the file too much work for what you want? Dec 7, 2012 at 12:19
  • 2
    This seems to violate a principal of simplicity. In addition the ironkey is a proprietary black box, and users do not have knowledge of inner workings. I want to audit my security, and no third parties unless I understand them. Jul 13, 2015 at 18:36
1

According to Cirrus Legacy in terms of the United Kingdon (they also have a site for the USA & European Union)

UK Wills don't include digital assets. So unless you've listed the logins, passwords and membership numbers of all this stuff - your digital inheritance - somewhere accessible and sensible, your relatives can't cancel, change or transfer it after your death. Unless you want your Twitter profile haunting everyone forever, it's best to sort things out right now!

Secure your Digital Legacy effectively & save your wife alot of hassle:

http://www.cirruslegacy.com/

(I'm assuming this can be used for emergencies as well as when you pass away. Unless they have a specific clause that the information can only be passed on with presentation of a death certificate.)

There is a free account available, as well as different tiers of paid membership available

1
0

While KeePass is the must obvious solution, I think classic pen+paper could do a job too and is easy to use for non tech-savy users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .