2

A lot of personal life is digital and should be protected to stay private.

But in case of a medical emergency, like being unresponsive in hospital, maybe being in a coma for a few years (possibly waking up afterward) or dying, one may want to share some information with relatives. An example would be:

When I am unresponsive in hospital, please use the following login to renew my payments for service x, z, y, so they do not get canceled.
When my emergency takes longer than four weeks, please inform these people: A (a@mail), B (b@mail). Please also notify people I am chatting with in the private chat C. My login (please keep it secret!) is user:password
In case of my death, please also inform D, E, F and delete my accounts G, H. The needed usernames and passwords are (...)

Or something along these lines. I guess writing the actual digital last will is a huge task by itself, but the problem that comes before is how to protect it until it is needed on the one hand and make sure your non-technical relatives can access it on the other hand.

Just having a letter stored at home and informing one's relatives is one option, but someone may steal it and get a lot of access rights and personal information, e.g., about private contacts that you did not want others to know about, except in emergencies.

Schemes like Shamir's secret sharing are probably one way to protect it, but they are both technically challenging (think about the average user), even the concept is hard to grasp for some, people may lose their share of information or not cooperate, and when one makes it too complicated, people think you're paranoid or at least strange.

Finally, one should be able to update the information. This would, for example, mean sharing a password and an URL, so you can upload the updated encrypted information each time you're adding something. This not only exposes the (encrypted) list but also poses a risk of being unreliable. Maybe one did not check if the URL still works, and for some reason, the site you chose to host the list deleted it. Then people will find the instruction and password but not be able to download the information.

What are good ideas to share sensitive information with non-technical persons, such that it can only be accessed in emergencies?

Existing solutions:

  • Web services like Google allow you to define what happens to an account after your death. This solution would, for example, allow you to store a list with all necessary information in your mailbox.
    On the other hand, you need to trust Google not to abuse it (most people are probably not a target of people who may have access, trust Google to verify the necessary documents and trust Google not to have security incidents in which people may access your mailbox and your list with everything needed to take over your online life.
  • Building yourself some kind of dead man switch. This is an option that both needs a lot of maintenance and a lot of care not to trigger false positives or false negatives, as both have grave implications.
  • Some companies offer to handle such cases. I didn't look up the current offers, but there are companies who provide this service as far as I know. But here, you need both to trust the company and its security a lot because everyone knows that such a company stores are a lot of sensitive data that may be of interest for either misusing it or extorting its owner.
2
  • IIRC, some big web services offer this for their accounts, e.g. Google. Mar 19 at 3:07
  • The company business is keeping secrets, so why would they put their business at risk and not taking a lot of care about those secrets?
    – ThoriumBR
    Mar 23 at 1:12
2

Search around for a digital dead man switch. You can build one yourself, and keep checking out on it every day or week to keep it from triggering.

With a cheap VPS (you can buy one for a dollar or less per month), you can have a simple service running that you write the rules, and what should be sent by email and to who.

So if 2 weeks passes without you checking in, login for the payment is sent. After a month, people are informed. And after an year, the request for deleting your data is sent.

You only have to be sure to not let the switch trigger before it was intended, and keep enough credits on the VPS account to outlive you at least one year. Renewing it for 2 years, and refunding it halfway would be enough.

2
  • I think reliability is the crucial point. One neither wants the switch to trigger because the hoster has a problem nor the switch not to trigger because something went wrong. I self-host a lot of stuff, but self-hosted things will stop working, sooner or later, when you're not around. So when I want the switch to trigger after four weeks, and after two weeks, the provider sends a downtime announcement, I am not around to make sure the switch is not triggered yet. And one would probably need to test it from time to time, like one needs to test if backups can be restored when needed.
    – allo
    Mar 17 at 17:44
  • I self host a lot too, and I know what you mean. A system that bothers you every week will end up shutdown, and a system that does not will be forgotten and your wife receives "If you are reading this, it means I am dead..." when you are inside a datacenter without internet reception.
    – ThoriumBR
    Mar 17 at 17:58
1

With non-technical users you want a non-technical solution that does not rely on anything that requires more than, say, e-mail and web basic knowledge.

A simple approach is to find two people whom you trust and have regular contact with, but that do not know each other or meet in normal life. Send an encrypted file with your information to one of them, and the key with instructions on how to use it to the other (ideally, a GUI decryption app). Also give the contact information for the other person to them both, with instructions on when to use them (e.g. "if you know I have an emergency, or didn't hear from me for a week and I don't answer my phone or respond to messages for a day.")

Trust in these people ensures they won't just call each other and say "hey, let's check what allo thinks is so important" - because for that to happen, you would have to be wrong in both of them AND they need to start that without knowing if the other person will cooperate or rat them out to you. So that's three things that would have to go wrong.

People you have regular contact with means they'll know if you had an emergency, even if they don't know the nature of it. But if you typically talk to your best friend every 2-3 days and then disappear for a week, they'd know something is wrong because you would've told them about a holiday.

This can theoretically be expanded upon, by having two keys (for three people) or having two sets of people with two files and two keys - whatever you need.

You don't always need a high-tech solution. Especially for things where you really don't want some technical failure to block things if something goes wrong.

1

Assuming you keep all your accounts in a password manager, then the problem becomes granting access to your password manager to someone else in the event that you are incapacitated.

This is sortof a cheap answer, but assuming there is at least one person in your life that you trust, give them your password manager master password to store in their password manager. Or write it down and put in a family safety-deposit box at a bank, or in a sealed envelope in a family member's personal safe, etc.

1
  • 1
    This is not a cheap answer. In the end, it boils down to two things: First, allowing people to access the password (and possibly some instructions) after your death, and second, perhaps hosting the database of the password manager where it is easier to update than, for example, a printed password list in a safety-deposit box. The main concerns are about how to deposit it in a secure manner that prevents unauthorized access and how to inform people how to access it. The two goals may be contradictory, as someone you want to inform may be nosy while you're still living.
    – allo
    Mar 24 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.