Japan’s National Consumer Affairs Center on Wednesday suggested citizens start “digital end of life planning” and offered tips on how to do it. The Center’s somewhat maudlin advice is motivated by recent incidents in which citizens struggled to cancel subscriptions their loved ones signed up for before their demise, because they didn’t know their usernames or passwords. The resulting “digital legacy” can be unpleasant to resolve, the agency warns, so suggested four steps to simplify ensure our digital legacies aren’t complicated:
- Ensuring family members can unlock your smartphone or computer in case of emergency;
- Maintain a list of your subscriptions, user IDs and passwords;
- Consider putting those details in a document intended to be made available when your life ends;
- Use a service that allows you to designate someone to have access to your smartphone and other accounts once your time on Earth ends.
The Center suggests now is the time for it to make this suggestion because it is aware of struggles to discover and resolve ongoing expenses after death. With smartphones ubiquitous, the org fears more people will find themselves unable to resolve their loved ones’ digital affairs – and powerless to stop their credit cards being charged for services the departed cannot consume.
Password manager with a delegated access structure is the way to go. If my sister (who I have delegated to) requests access, provides a death certificate,and waits some cool-off period, she gets access to the portions of my password vault I designate. I will grant her access to my financials upon death, but not social media and private stuff.
Versus writing it down and giving it to a lawyer who probably has the same opsec as their 1920s counterpart.
Also are you going to update if every three months when you change your passwords? Writing it down gives only a false sense of legacy access that will likely never end up working
Let’s be realistic here. People ain’t changing their passwords every month, 3 months, even yearly.
Can you please let us know what password manager does what you said?
You can self host Vaultwarden, which is essentially self managed Bitwarden.
And the feature can be setup fairly easily.
Okay, but if you’re self hosting it, then die, and the hosting has an issue during that time? You’re SOL.
Don’t try to self host things like a dead man switch.
The likelihood that I die, and my loved ones decide to just turn off the server while knowing it’s where the Vaultwarden software lives, before they get access to said Vaultwarden, is very very slim.
Self host whatever you want. Even Deadman switches.
The key is informing your loved ones the requirements for the switch. Just like if they don’t know to request access in other Deadman switches.
And if the hard drive goes out?
Cmon, you can’t tell me you’re comfortable with a 2 week “anything could happen” period where all that information could just disappear forever.
I can definitely tell you I’m comfortable with that.
If family doesn’t know I’m dead in 3 days, they ain’t family.
Bitwarden has this, you can set your next-of-kin and they’ll be able to get access. (They have to wait like 2 weeks or so and I imagine all sorts of alarm bells will go off if they try this while you’re alive). Might be a premium only feature though idk.
It is premium only to configure, but doesn’t require premium to execute once configured.
The BitWarden Emergency Access feature is premium-only to setup. And it doesn’t have the death certificate/identity verification piece to it, which I prefer not having anyway.
Wait how does that work? I thought Bitwarden couldn’t access your passwords, how could they grant a third party access to your passwords without your master password?
my understanding is:
- the emergency contact sends their public key to the owner of the vault
- the owner encrypts the key for the vault using said public key and stores the result on bitwarden’s servers
- the emergency contact can now request the decryption key from bitwarden, which they will receive either if the vault owner manually approves the request or if the request is not rejected within a certain amount of time
- the emergency contact can then decrypt the stored vault key using their private key, and use that to access the vault
Eh The things that actually matter, like phone, banks and utilities, and just about everything else, only require you tell them of the death. They might want proof such as a death certificate, but that’s normal.
The article mentions things like auto-payment subscription services which can definitely be a pain to deal with (even while you’re alive lol). Depending on how the payments are setup, it can be as easy as having the bank cancel the debit/credit card. For direct debit from checking accounts, though, it’s often a lot more complex to get stop payments on those (been there, unfortunately).
So leaving your account details (in a password manager, text file, notebook, etc) has some tangible benefits. At the very least, it makes it easier on your survivors to handle your affairs.
Oh don’t get me wrong, i think it’s a good idea. Just be mindful that financial companies (for example) don’t think you’re in the account fraudulently. Tell them the person is deceased and then provide the account info you have.
Well, yeah, for banks and “official” services like that. Otherwise, it’s fraud and you’ve got a whole new set of issues to deal with.
Strangely, I used to work for a bank in their “bereavement services” department; that is, the department that dealt with dead people’s accounts.
If anyone notified us of a death of an account holder, and provided any proof (death certificate, coroner’s report, police letter), the first thing we’d do is freeze the account. All payments out stopped, all cards cancelled, all withdrawals blocked. This was a legal requirement, because once somebody dies their money becomes the legal property of their “estate”, and it’s unlawful for anyone to remove money from the estate without following proper process.
There’s no need to stop each payment individually. In fact, the bank really doesn’t want you logging in to their online bank using the deceased’s credentials and messing around with things for the same reason; unless you’re following proper procedures, it’s not yours to mess with.
Possibly it’s different in different jurisdictions, of course.
This is a symptom of the absolutely insane way digital payments work.
You give a company your card details and they’re able to charge whatever they want, whenever they want, by default. That’s like paying at a restaurant by handing the waiter your entire wallet and telling them to take out the cost of the meal.
That’s like paying at a restaurant by handing the waiter your entire wallet and telling them to take out the cost of the meal.
Isn’t that basically how it works in the US?
Yes, yes it is. The only deterrent really is the will of the employee to commit fraud and/or a customer noticing. I’ve had to handle coworkers in the past writing in tips on blank tip lines on the reciepts that the customer signed.
Everything made by sufficiently big orgs works like this.
They care about ability to be do everything by themselves and easily.
They don’t care about sanity of the system for the user, because there are crowds of users, what are they going to do, barter?
And the worst part is where the biggest org of all these, the government, makes requirements that can only be fulfilled by big orgs.
You can’t win playing by the rules your opponent sets. EDIT: Unless they do some sort of Ulysses’ pact, but they won’t.
Fuck all that. My shit will erase itself if i don’t check in. The family can eat a bag of dicks if they want my data.
This. Why would anyone want their private conversations, out there? Don’t put your password in you will. Put a dead man switch on your PC.
If it is to close down a social media account they can contact the company directly.
If it is to take out money, they can contact the bank directly.
If it is to inform contacts, they can live without knowing.
If it is to cancel subscriptions, you’re going to have to send letters, wait in a phone call for hours, and cancel the credit card either way because of scummy cancellation practices.
Or just give them the passwords to control some things, but not all?
That’s just good advice. Personally, I use a password manager.
Yeah. The only complicating factor is there are still some very stupid services that force periodic password changes (or at least I still have to deal with such stupid services with terrible password policies).
