Ask Slashdot: How To Securely Share Passwords? 402
THE_WELL_HUNG_OYSTER writes "My tech-savvy father died suddenly and unexpectedly. He did everything online: bill-pay, banking, eBay sales (and other auction sites), PayPal, investing, etc. When he died, he still had online auctions up for sale, items I had no idea how to fulfill when sold. He still had unprocessed auction refunds, people claiming they returned items and are waiting for a refund. Fortunately, he left Gmail open and logged in when he died, so I was able to configure his account to forward to mine for any future emails he received. He even had his health insurance automatically debited from his checking account (who needs health insurance when they're dead?) I had no way to log into these systems to cancel pending transactions. I called every institution; some were willing to help while others required me to fax/mail death certificates and proof of executorship (which I didn't have yet). Meanwhile, auctions were selling for items I had no idea how to fulfill; debits from his checking account were occurring even though they were irrelevant; etc. You get the idea. How can I share my login credentials with my siblings so they don't have to go through this when I'm gone? I change my passwords every month and never use the same password on more than one site. I don't want my siblings to be able to impersonate me unless I'm dead, so publishing a monthly list to them won't help and would be insecure."
Dont worry about it (Score:5, Insightful)
duh? (Score:5, Insightful)
Write them down.
Leave the sheet of paper in your desk drawer, locked if you're paranoid.
Done.
Secure password storage and an attorney (Score:5, Insightful)
Place your passwords into a secure repository (like KeePass) and keep it updated. Give the password to the repository and other containers (I keep my KeePass in a TrueCrypt container) to someone you trust to execute when you die. An attorney. A trusted friend. Etc.
If required, make the password a two-part thing and give each part to different people.
Re:Dont worry about it (Score:4, Insightful)
Yes, but there's plenty of files that I personally want protected against prying eyes while I'm alive, which I wouldn't mind relatives seeing after I've passed. It is private information, but once I'm dead, I do kind of like the idea of people getting to see the areas of my life which were too private for me to be comfortable sharing in life.
The challenge is finding a way of disclosing those passwords without the possibility of a subpoena getting at them. I think pretty much the only way is to involve an attorney so that you can have attorney client privileges and then have the attorney disclose those after you're dead.
I don't believe that wills are protected in that way typically, you probably could send it to yourself via the post office, but I'm unsure as to whether subpoenas could force you to open them. Sending them internationally certainly would allow for them to be opened by ICE.
Re:Keys to the kingdom (Score:4, Insightful)
You may be able to access it but you are likely not able to legally access it.
The passwords are necessary, but not sufficient.
Short answer, seek appropriate legal advice. Laws change from place to place and time to time. Your specific requirements may not be generalizable. It might cost you a couple of hundred dollars and might save you thousands.
Re:KeePass (Score:4, Insightful)
KeePass is GREAT. I've talked my mom and wife into using it. My mom simply put the master password in her safe-deposit box and left instructions in her will to allow us access to it. My wife and I simply shared our strong master passwords with each other and stuck them into our respective KeePass DBs.
It is a bit of a hassle keeping everything up-to-date, but it is well worth the hassle you leave for your loved ones to try and sort out potentially dozens of passwords after you're gone. Just think about how hard it is sometimes to prove that you own an account that you've forgotten the password for. Now multiply that by the fact that you're dead and your loved ones have to prove that you intended for them to get into your accounts.
Do your family a favor and make it easy for them to find all your passwords in the event that you kick it sudenly.
Re:Dont worry about it (Score:4, Insightful)
It is easy store a copy of passwords on an ecrypted drive. In your will leave the password . It can't be touched until you die. Update the password with the will. Nothing can legally be touched with your accounts until your estate has been settled. So with the will is perfect.
Re:We had similar problems (Score:3, Insightful)
Re:Not your Will (Score:4, Insightful)
Will are only public after you are dead.
You missed the point that if you die your accounts are frozen as part of your estate. Joint accounts however remain un changed.
No one is to touch your ebay account even with auctions pending until after the will has been read. That is part of estate law.