PassMyWill Is A Will For Your Online Assets And Passwords(techcrunch.com) |
PassMyWill Is A Will For Your Online Assets And Passwords(techcrunch.com) |
I wonder if PassMyWill has ever been audited for security vulnerabilities? LifeEnsured has: https://www.lifeensured.com/faqs#security
EDIT: lol. The login form on PassMyWill gets POST'd over HTTP.
EDIT2: Nope, the entire server doesn't support SSL. facepalm
Even people that do security well need to engage in security theater.
Edit: ah, here it is http://news.ycombinator.com/item?id=2935220
Probably the best solution is to have something like 1Password set to automatically manage passwords, encrypted with a master password, and then disclose only enough information to get to the daily-use 1Password. Disclosing a single password like that is probably better accomplished in a paper will, stored with a lawyer/executor.
Although there's also some value in an "I'm dead" script which deletes porn, porn passwords, information about your affairs, criminal activity, compromising photos involving porn and crime and drugs, the Guatemalan second family you support, etc., before turning over things like facebook passwords to next of kin.
Then, just leave your master password(s) for the encrypted database in your will, or safely amongst your personal belongings.
He had a busy life online, post-retirement - built and ran a website for a yacht club, used the computer to book stand-by travel with his former employer (American Airlines), online banking, etc.
Nothing where the lack of access would have been a killer. But not having them would have been inconvenient for a lot of people.
Happily, he kept his accounts and passwords in a tablet, on his desk. Single-space, filled the page. So I was able to hand the 'keys' of the website over to his backup, get my mother logged in to the website so she can book tickets, and so on.
Every single online account would have been excessive. But the ones he documented, I'm glade he did: saved a lot of people some inconvenience.
* Be secure with your credentials to sites * Reliably figure out that you are dead * Trust that your next of kin will figure out the key you've set up
It's certainly a useful concept and much better than hoping your loved one placed the credentials somewhere you could access them.
Encrypt your package using a fresh private key. Send the package to the will handler (such as PassMyWill), but not the key. Send the key to all the will recipients.
Upon the execution of your will, your recipients get the package that they can already open with their key.
The trick becomes to keep the package opaque to the will handler, and to keep the recipients from gaining access to the package prematurely.
Then you could nominate some family members, friends, significant other, such that some minimum number of them were required to collaborate to decrypt the files.