I am looking for a modern, password manager-based way to share my passwords with certain parties (partner, executor of my will) within a week or so of my death, but no sooner.
The scenario I wish to avoid is the loss of my assets and/or breach of my privacy during my lifetime. My threat model includes betrayal of trust and physical access (as in thieving roommate, not the NSA) to my personal papers, keychain, hardware security key, and password-protected phone/laptop. I use 2FA (some with security key, some with phone-based Authenticator apps) for all my accounts.
Regarding betrayal: I accept that someone I'm concerned will betray me in life could just as well betray me after death. While I hope that doesn't happen, that's between them, my intended beneficiaries, and the legal system -- I'm looking to protect my interests while I am alive. So handing someone my passwords on a plate as recommended by e.g. Wirecutter is a nonstarter.
I reject solutions that rely on:
- Physical security, e.g. printed out master password or safety deposit box key (thieving roommate)
- Trust, e.g. sharing the password with someone and hoping they don't use it until I die. (I do trust established entities like Apple, Google, Dropbox, 1Password, etc., but not random third parties like Joe's Password Manager or https://www.deadmansswitch.net/)
- Keep-alive toil, e.g. weekly "click to confirm you're not dead yet" emails
- Shoddy facsimile of a password manager, e.g. maintaining my own encrypted list of passwords outside of a password manager
- An attorney: I don't have one, and they are much more expensive than a password manager
Ideally, I would have a password manager that lets me designate a list of allowed requestors. If any of them requests access, I have (say) 14d to approve/deny the request (during which time I'll be aggressively pinged), after which I'm presumed dead and the request is approved.
A very similar question was previously asked in 2013, but none of the proposed solutions meet my requirements:
- Use a lawyer (explicitly ruled out)
- Encrypt the passwords; give party A the passwords and party B the key: This is an awful solution, ticking both the 'shoddy facsimile' and 'trust' boxes.
- Google's Inactive Account Manager: This has a minimum 3month delay, and doesn't reveal passwords. Maintaining a doc/email would again be a shoddy facsimile.
- Dead man's switch email service: Keep-alive toil, and sketchy 3rd-party
- Written down password and/or safety deposit box: physical security
- "Estate Map", a defunct service that amounted to "use a lawyer"