Ask Slashdot: How To Protect Your Passwords From Amnesia?

Phopojijo writes "You can encrypt your password library using a client-side manager or encrypted file container. You could practice your password every day, keep no written record, and do everything else right. You then go in for a serious operation or get in a terrible accident and, when you wake up, suffer severe memory loss. Slashdot readers, what do you consider an acceptable trade-off between proper security and preventing a data-loss catastrophe? I will leave some details and assumptions up to interpretation (budget, whether you have friends or co-workers to rely on, whether your solution will defend against the Government, chance of success, and so forth). For instance, would you split your master password in pieces and pay an attorney to contact you with a piece of it in case of emergency? Would you get a safe deposit box? Some biometric device? Leave the password with your husband, wife, or significant other? What can Slashdot come up with?"

Comments

Secure safe.

[Anonymous Coward]

Tell all your passwords to me, they'll be safe. Just don't forget who I am.

Re:Secure safe.

[wonkey_monkey]

Like that'll ever happen. You post here all the damn time.

Re:Secure safe.

[FatLittleMonkey]

More seriously, envelope, lawyer, retainer, instructions to return if you are in a serious accident. Or several lawyers, each with part.

Or cheaper but less reliably tell two or three independent friends a part of the answer, and ask them to come and tell you the information if you ever get amnesia. Such as, "The password is in the book"; "Moby Dick"; "Page 27, Line 6". Don't tell them who the others are, and try to use people from different social circles.

Re:Secure safe.

[FatLittleMonkey]

"The password is in the book"; "Moby Dick"; "Page 27, Line 6"

Oops. Heh.

"unlock his bridegroom clasp--yet, sleeping as he was, he still hugged me tightly"

Oh Queequeg...

Re:Secure safe.

[fuzzyfuzzyfungus]

It seems like it really depends on (A)the threat model and (B) your tolerance for inconvenience.

A safe deposit box, say, won't last 10 seconds against The Man (unless you bank with the same Bespoke Swiss Wealth Management Entity whose gnomes have guarded your family's anonymous riches since the days when you were aristocracy); but is pretty much 100% bulletproof against hackers, malicious friends, and most other likely attackers with the possible exception of a malicious-but-once-trusted spouse. Plus, while it might be a bit of a hassle, especially if you face serious cognitive impairment, such an arrangement is well established enough, socially and legally, that regaining access to your box after an accident or something should be pretty doable.

Something like that would be too much of a hassle to routinely deposit updates to passwords you rotate frequently; but a good place for a long, hostile, master password for a password locker of some sort that you use day-to-day and store the passwords that actually get rotated in.

If the concern is The Man, of course, you could hardly do worse than that strategy. Depends on what you are worried about. If you aren't worried about the man, just putting it on paper in one of the institutions society has offered for secure storage for centuries now is the obvious strategy, and comes with the advantage that even 100% non-techies will be familiar with, and likely to be helpful with, such an arrangement. If you are worried about a warrant cutting through your security like a stray round through an innocent bystander, you'll need to get more creative, and hope that you have some social resources to employ.

Biometrics are always a terrible plan, of course (sure, your fingerprint will be fine after you get out of the burn ward, no problem...) and KISS is probably a good idea if your concern is the potential for unplanned mental degradation (whether pure memory, or cognition as well). The fancier you get, the worse your odds of remembering how your fancy plan to remember your passwords worked.

Re:Secure safe.

[morethanapapercert]

Small problem with your approach: It relies on you knowing what to DO with the N number of pieces given to you by your friends. Sure you may get back A, B, C...but your description seems to imply that the requirement to perform an XOR operation on the pieces is not part of the data you have given to friends. Is your resulting password WhiteSuitRicardoMontalban, WhiteRicardoMontalbanSuit or RicardoMontalbanWhiteSuit? You need the generation method to be part of the recovered data, not just the "seed" if you will. Otherwise you won't know if you need to XOR, concatenate, follow the breadcrumbs or use a simple substitution cipher on the pieces.

A similar problem lies in most of the other "tell N friends to give you the clues needed to find the password" approaches. What happens if one or more friends fail to return the clue they possess? It's like having a hard drive array as a simple spanned volume. Lose one drive and everything is lost. Trying to include a checksum or similar function seems needlessly complex IMHO.

I think most folks are over-thinking this. Lets stipulate that I have lost my memory for whatever reason. All my passwords are generated using a relatively simple pattern. If I was amnesiac, I still have all those passwords saved in my browser, chat and email clients. Amnesiac me can collect email and log into sites that I use as long as my computer is intact. My wife knows the pattern but not the current passwords, if I can't get into the password lockers, my wife can give me the starting point. From there I can access my passwords with as little as 5 tries. However, as long as my email client still has useful passwords, the vast majority of my password list can be reset with a simple "I forgot my password" request. If, for whatever reason, those two options aren't good enough, I really don't care y'know? If I'm amnesiac, I have much bigger problems on my plate than whether I can access any social sites, member-only areas of sites and so on. Given the kind of brain trauma needed to get significant amnesia, I probably would not have much use for email for the first while anyway.

Just post it on Slashdot

[michelcolman]

And then, whenever you need your password, just "ask Slashdot"! Of course there will then be some jokers who post incorrect passwords, but they will be modded down rapidly since anyone can check whether the password is correct or not. Just go with the "+5 informative" one.

Re:Just post it on Slashdot

[master5o1]

Remember, posting your password on the internet will show the password to you as as your password, but others will see it as stars.

See, look at my password ************

So now if I get amnesia all I have to do is come back and check my comment history and I'll find my password.

Re:Just post it on Slashdot

[oodaloop]

Yeah, I use a bunch of asterisks for my passwords too.

Re:Just post it on Slashdot

[yincrash]

The problem with this (along with other plans), is that if you get amnesia and forget your password, there may be the chance that you forget where you stored your password as well. So, to be a good plan, it has to involve you either stumbling on to it quickly, or having someone / something tell you it once they get news that you have amnesia.

Re:Just post it on Slashdot

[isorox]

Remember, posting your password on the internet will show the password to you as as your password, but others will see it as stars.

See, look at my password ************

So now if I get amnesia all I have to do is come back and check my comment history and I'll find my password.

So your password is hunter2?

Paranoid much?

[Anonymous Coward]

Amnesia is most often associated with major brain damage, which means you have a lot more to worry about than your passwords. Now zombies, those are real, which is why I'm holed up here in the middle of Nebraska with enough ammo to put the entire state out. You hear that zombies, you'll never take me alive!

Re:Paranoid much?

[stranger_to_himself]

Amnesia is most often associated with major brain damage, which means you have a lot more to worry about than your passwords.

Also with ageing - not just in dementia. My parents in their 60s/70s both struggle with remembering secure passwords.

A piece of paper in a drawer

[captainpanic]

For work-related passwords, my boss has every right to know my passwords if I get sick. So, it makes sense to store them offline (e.g. a piece of paper in a drawer at the secretary's office). The security my passwords then relies on the security guards at the gate.

For my personal passwords, I rely on security through obscurity: I don't believe that anyone can find my passwords in the giant mess that I call my office. If I get sick, I can use the recovery time to clean up my office. It will take weeks, if not months.

Btw, I don't need a terrible accident to forget passwords. It happens a lot for those passwords that I don't need too often.

Re:A piece of paper in a drawer

[txoof]

A trusted executor is really the way to go here. Store the passwords in an encrypted format and then give the key to a trusted party that will only unseal the encrypted database in the event that you are incapacitated. For added security, split the key into multiple parts and give it to multiple parties. It would probably be best to transport the key in a physical format and make it clear that the importance of the document.

In a work place setting, give the keys to supervisors that are mutually responsible for the systems in question. In a personal setting, give the keys to family members that are trusted. Be sure to provide step-by-step instructions as to how to decrypt your data. If you are so unfortunate to not have trusted family or friends, pay a law firm to administrate this service and act as your executor. For a fee, the law firm can be instructed to only unseal the data in the event that certain standards are met (such as a declaration of incompetence by N medical professionals).

Re:A piece of paper in a drawer

[Anonymous Coward]

For work-related passwords, my boss has every right to know my passwords if I get sick. So, it makes sense to store them offline (e.g. a piece of paper in a drawer at the secretary's office). The security my passwords then relies on the security guards at the gate.

This is the way to go.
The first question you should ask yourself is, if someone have physical access to my computer, do I care if they also have my passwords. If not then a post-it on the monitor will work just fine.
Otherwise you should ask yourself, do I have any physical place where someone finding out my passwords would be the least of my concerns? If you have a place like that, store your passwords there.
As long as you don't store what the passwords are for together with the passwords some random stranger getting hold of your passwords won't be that much of a problem anyway.

Re:A piece of paper in a drawer

[Zachary Kessin]

I would probably give a master password and a copy of my password safe to my lawyer, along with my will and other legal paperwork that she should have just in case something should happen to me.

Re:A piece of paper in a drawer

[Anonymous Coward]

For work-related passwords, my boss has every right to know my passwords if I get sick. So, it makes sense to store them offline (e.g. a piece of paper in a drawer at the secretary's office). The security my passwords then relies on the security guards at the gate...

Your boss does not have "every right" to know your password at work any more than any other employee has a "right" to know it. You are an IT Security person's worst nightmare with that bullshit argument, especially if you have even a fucking hint of how Windows security works, and know damn well that in any emergency, most any member of your IT staff can reset any password upon following proper HR and IT policy, which is your audit trail as well for CYA.

Work passwords pretty much for the most part do NOT need to be stored offline in any way for this very obvious reason, and by relying upon the security guards, you've basically destroyed any point in having any sort of strong password policy.

Like I said, you're an IT Security person's worst nightmare. Knock it off with that shit already, and use common sense.

Re:A piece of paper in a drawer

[aaribaud]

For work-related passwords, my boss has every right to know my passwords if I get sick

Hmm, no, he has every right to access your professional data for sure, but this does not necessarily require him to know your passwords. Back when I was doing IT for a 25-odd people company, I'd briefed people that their password was like their signature: personal, and if some manager asked them their password, they should redirect the manager to me (happened a few times, each time the request was baseless and rejected, and when there was an actual problem, it was solved without anyone having to let anyone else know their password). Heck, I'd briefed everybody never to tell me their password.

Re:A piece of paper in a drawer

[pla]

For work-related passwords, my boss has every right to know my passwords if I get sick.

Absolutely not. Your employer has every right to reset your work-related passwords to gain access to your machine - An easily detected, even auditable, event that proves "you" didn't try to bribe a Central American dictator to use your company's brand of widgets (or bullets, as appropriate).

Now, for truly shared company passwords like a corporate Twitter account, you should already have a key escrow plan set up - That might mean a formal third-party service, or something as simple as the old trick of writing it on a note-card, sealing the note-card in an envelope, and signing across the flap. Store envelope in a secure area.

Don't confuse those two situations.

Re:A piece of paper in a drawer

[DarkOx]

For work-related passwords, my boss has every right to know my passwords if I get sick. So, it makes sense to store them offline (e.g. a piece of paper in a drawer at the secretary's office). The security my passwords then relies on the security guards at the gate.

Disagree.

Your boss has every right to possess credentials himself capable of resetting or changing your password to something he knows; should a need arise. He should not however have your password. This is a audit and separations of powers issue. Being able to reset your password is fine, that should result in a log, of what account was reset and what account did the resting. If it was root, who sudo'ed to root, etc. Can someone with administrative access still taper with logs? Yes; but it raises the bar and makes it harder to cover their tracks from forensic examination if something happens.

Account credentials should not be shared for accountability reasons, even with the boss.

Re:A piece of paper in a drawer

[ifiwereasculptor]

do I have any physical place where someone finding out my passwords would be the least of my concerns? If you have a place like that, store your passwords there.

You just gave me the best idea ever: tattoo your passwords on your penis. The chance of losing it is small when compared to the chances of losing a notebook or piece of paper, it's a private location and chances are social engineering industrial espionage attempts will have to get pretty interesting. I can see only two minor problems with my plan: first, you might not be able to fit strong passwords in there. If you end up only being able to fit easy to brute force passwords, I suggest you use the old piece of paper method, and maybe a pump. Second, your work may be one of those that use five or six different systems, all with different passwords, and rotate them on a monthly basis. You can still stick with the idea, but oh, boy, you're going to be sore.

Re:A piece of paper in a drawer

[pspahn]

I know that it might seem obtuse, but there are in fact companies out there that don't even have an IT department and chances are the "IT system" is just a bunch of random machines doing random things and password resetting isn't a practical option.

Re:A piece of paper in a drawer

[ObsessiveMathsFreak]

Once I smirked at people who wrote down their passwords, but now with every second site and service needed at least once email address and passwords, the smirk has been wiped off my face.

I now have upwards of 100 passwords and logins across computers, websites, mailing lists, services, databases, devices and an increasing number of newly online ultilities. I would point to this hassle as the number one example of computers decreasing productivity.

I've remembered the most important logins, doubled up others, and now simply resorted to writing down most of the crud. Somehow the simple login became an unending beuracratic headache and the internets most common barrier.

Re:A piece of paper in a drawer

[shikaisi]

I'm not bragging, but I just wanted to mention that I've got plenty of room for strong passwords.

Re:A piece of paper in a drawer

[MightyYar]

I agree with you on policy, but technically the boss has the right to have whatever policy he wants. It's his company, after all. Now if your "boss" is just the manager directly above you, they may very well be violating some company policy...

Re:A piece of paper in a drawer

[DiSKiLLeR]

Umm... what about server passwords? What about core router and switch passwords? What if you work at a telecommunications company and are in charge of the a large part of the network?

Do we want another Terry Childs incident here?

OF COURSE your Boss has every right to know your passwords. Maybe not your personal windows login password, but that is NOT what we're talking about here. Passwords to core and critical systems in a business SHOULD be accessible to senior management in case something should happen to you.

Of course we're side tracking from the OP's original question at this point.

Re:A piece of paper in a drawer

[JackieBrown]

At work, when one password expires, I update all of my system passwords to match whichever new password I pick.

I used to come up with clever, difficult to guess passwords. Now that I have to change my password every three months, I just +1 my previous password. Farscape20 is what I was at before I switched shows.

If my job really expects a challenging password, then it should stop forcing me to update it so frequently. I am simply not imaginative enough (nor do I have the desire) to come up with something unique each time.

Re:A piece of paper in a drawer

[shadowrat]

Well, i guess we finally have some hard proof of men being better suited for work in the tech field.

Re:A piece of paper in a drawer

[TeknoHog]

So you're hung like a correct horse, with a battery staple?

Do what Jason Bourne did

[wisebabo]

Tattoo your safe deposit bank number (the bank of which required your biometric identity to get into the vault) on your arm. Maybe you should also tattoo the name of the bank (and address?) there, I seem to remember that he had problems remembering he had a safe deposit box there.

Re:Do what Jason Bourne did

[isorox]

Tattoo your safe deposit bank number (the bank of which required your biometric identity to get into the vault) on your arm. Maybe you should also tattoo the name of the bank (and address?) there, I seem to remember that he had problems remembering he had a safe deposit box there.

Make sure the biometrics isn't fingerprins from the same arm, otherwise someone may chop your arm off and get both the bank name and the fingerprints in one go. People will do anything to get to your funny kitty pics on instagram.

Nice try

[sc0rpi0n]

Nice try, NSA!

Sealed Envelope

[Anonymous Coward]

IIRC, Nemeth, Hein, Snyder, and Whaley suggest a sealed envelope in a safe (or locked away in a safe place). As soon as the seal's broken, you know that the person(s) who know(s) the combination/has the key indeed needed access to the password (in an emergency), so you may want to change the password in the future.

Use mooltipass

[mathieu.stephan]

At Hackaday we're actually developing a solution that could work in your case. The concept behind this product is to minimize the number of ways your passwords can be compromised, while generating and storing long and complex random passwords for the different websites you use daily. It is designed to be as small as possible so it can fit in your pocket. The Mooltipass is composed of one main device and a smartcard. On the device are stored your AES-256 encrypted passwords. The smartcard is a read protected EEPROM that needs a PIN code to unlock its contents (AES-256 key + a few websites credentials). As with your credit card, too many tries will permanently lock the smart card. Therefore, you'd only need to share your PIN code with your husband/wife (5 to 6 numbers) And the whole project is open source.... http://hackaday.com/tag/developed-on-hackaday/

Re:Use mooltipass

[Ozymandias_KoK]

I think he meant THE husband / wife, I.E., dad and mom. You could just ask her when she brings down your sandwich.

Re:Keep it on a piece of paper

[Joce640k]

Your brain is the limit!

Sure, unless you wake up with memory loss (it can happen, it seems you forgot the words of the summary while you were writing that!!)

Why is "forgetting" such a problem apparently?

[Rosco P. Coltrane]

It's very easy to create unique passwords that are hard to guess, and completely trivial to remember. My method is this:

- I have a 4 "stems" that are the first letters of 4 lines of poetry I remember from school. one stem is used for "very personal" things (ssh private key passwords for instance), another for login on "trusted" machines (my servers), and a third to use on various websites I trust moderately, and a fourth is a "junk" stem to use on shite websites (hotmail and the likes).

- To each stems, I append 2 digits (always the same)

- I prefix each stem with the first 3 letters of my username, and I append the 3 first letters of the machine's name, or website name I'm logging onto, after the digits.

- Finally, I append the number of letters in the machine name or website name (sans www. or .com).

The passwords that I create that way are reasonably secure, usually unique, and all I have to remember is a poem, my username for a particular machine/website (those I can store somewhere in plain text just in case) and the method to derive the corresponding password.

I have kajillions of passwords, and zero trouble remembering them. How hard can it be? I've never felt the need for a password storage solution of any kind.

Re:Why is "forgetting" such a problem apparently?

[OolimPhon]

"All I have to remember is a poem".

This won't necessarily work if you have amnesia! Poem? What do I need a poem for? And all that stem/prefix/append process, if you have amnesia, what's that all about?

If your passwords, and your password generating method, are kept solely inside your head, then that is a single point of failure. Fall off a bike and it may be gone. For ever. The point is to be able to somehow reconstruct your passwords if you can't remember!

Re:Why is "forgetting" such a problem apparently?

[Kjella]

The point is, I've used that poem and that method for so many years, and it's such a simple system, that it might be the one thing I'll remember first if I have amnesia.

Perhaps, perhaps not. I have a relative who suffered some brain trauma, he had to relearn parts of his vocabulary and while he'd fairly quickly relearn that an apple is an apple, any passwords, codes or combinations that only he'd known was blasted into oblivion. If that happened to me I'd lose everything on my computer since I use full disk encryption and nobody else knows the key. And it's not so easy to solve, because even if I wrote it down I might not remember that I did, where I hid it or who I gave it to for safekeeping. Essentially you need the trusted person to come to you, "I heard you hit your head pretty bad, do you still remember your password? You gave it to me for safekeeping." which narrows down the list a lot. So far I've decided to still take my chances.

I did something really clever

[Chrisq]

I did something really clever with my password list .... I'm darned if I can remember what though.

Re:I did something really clever

[Chrisq]

I did something really clever with my password list .... I'm darned if I can remember what though.

You emailed the list to me for safekeeping. Just send $10,000 (plus shipping and handling) to my paypal account, and I'll send it right back to you!

Sure ... just tell me my paypal password first, I can't remember it!

Re:Hire a lawyer

[Rosco P. Coltrane]

I'd rather give my password to a russian hacker than to a lawyer. The former is probably more trustworthy...

Republican answer

[korbulon]

Try not getting amnesia in the first place! Whore!

Vacation.

[leuk_he]

The real story:

You have a good password, that changes every 2 months. It is complex, and the previous password does not look like the current password.

Then you come back from a 2 week vacation and you have only 3 tries to remember your password.

happens way too often.

Re:Don't need even that

[Anonymous Coward]

Everyone forgets passwords once in a while.
Personal Passwords? Most of them can be reset. That is, if that email address still exists. Otherwise it probably wasn't important enough anyway.
Job passwords? Can be reset
Government related passwords (like DigiD in the Netherlands)? Reset it online and they'll send you a reset code via ye olde mail
My girlfriend suffered from a cerebral hemorrhage a couple of years ago.
Trying to get a new bank pass (she also forgot her PIN) was way more difficult than online stuff recovery.

Sigh

[ledow]

Write them down. In a notebook. Label what they are the password for.

Store book in safe place and update once a year.

That's how I do it for my employers (large fireproof safe, book sealed so you can't open it without me noticing, etc.) and for myself.

If you get to my safe, get into my safe, get into the book, then it's also game over for every PC in the house anyway, not to mention my Facebook password will be the least of my worries (banking token generators, etc.).

Seriously people, stop repeating the advice to "never write down passwords". Write them all down in one huge book and PUT IT SOMEWHERE VERY VERY VERY SAFE. Then if you die, if you're on holiday and someone needs to log in for whatever reason, if your other half is at home and desperately needs to do something important as you, then you can talk them through getting access or they will know.

If you don't trust them? Lock it in a cheap safe of your own. Worst that happens is that you have to get out the cutting discs to get back into the thing and get your passwords back if you have a case of total amnesia.

Re:Basic Master Password stored on a piece of pape

[Joce640k]

I have a master password which i then encode with a simple cypher of adding letters together. e.g. A + B = D.

I then get a sentence from a book/movie etc and essentially add these together:
myveryspecialpasswordisawesome
ALLYOURBASEAREBELONGTOUS

I then just stored the encoded version on a piece of paper around the house for example with a hint?
adsfaudfjuasdfjadsufadsfjadsfdsaf, Air force ....?

F.

The stated problem was: "Amnesia".

You appear to have answered a completely different problem.

Do what I did

[140Mandak262Jamuna]

Pick some nerdy site, say slashdot, and create an account. Use your password as the username, but it won't stand out in such sites. Cackling devilishly at the foolishness of the masses who do not realize that your password is hiding in plain sight is optional.

Use a PO Box

[Overzeetop]

Go get a small PO Box
Print a master list of passwords each week and mail it to yourself at that PO box
Every 3-6 months go clean out your box except for the most recent and shred them
Keep the key with you at all times.

Why use this over a safety deposit box?
  (1) It's a federal felony for someone else to remove or open the letters
  (2) You have a list no more than a week old (prior to your death or amnesia) available
  (3) If you should die or become incapacitated, your home/mailing address will get a reminder once a year that you HAVE a box, and where it is, by producing ID or appears certifying your death or incapacitation, your attorney or next of kin will get a notification that such a box exists and when they (or you) check to see what mail you've gotten they'll discover your passwords.

Re:I do not discuss matters of security

[itsdapead]

Actually, that "security through obscurity" approach is exactly how security does NOT work :-)

Funny. Relying on a password that nobody else knows sounds like "security through obscurity" to me.

KeePass + will

[chad_r]

I would probably give a master password and a copy of my password safe to my lawyer, along with my will and other legal paperwork that she should have just in case something should happen to me.

I was in the midst of posting something similar. I hadn't thought of encryption, but that would be a good idea.

• 1) Stored all my passwords in KeePass Password Safe, and protected the database with a single password
• 2) Attached the password for it, along with other important instructions (like a local password for the computer with the database), with my will. I also added a list of important contacts and bank accounts my family might not know about
• 3) Sealed the documents in an envelope, and let my family know about the documents (or left it with them, before an overseas trip)
• 4) Upon my timely death or loss of memory, my family will have all it needs to delete my embarrassing online photos

Just call

[Stumbles]

the NSA.

Dead Man's Switch

[fiziko]

Write a script with a "dead man's switch." Store passwords in an encrypted file on a secure system. If you don't log on and issue some sort of "wait" command every 30 days or so, then passwords get emailed to an account whose password is stored on a phone. At the time the passwords are issued, it's bloody insecure, but it should work well enough to get into the systems and change the passwords to something else. Not a perfect system, of course. What happens with a 60 day coma? Passwords are accessible for at least 25 of them, but not to you, etc. Existence of the script and encrypted file on an email ready system means there's a vulnerable spot there, too. It's better than nothing, though, and doesn't involve lawyer fees.

PassGuardian, with N of M secret reconstruction.

[grnbrg]

http://passguardian.com/

This uses Shamir's Secret Sharing algorithm to take your password, and split it into a configurable number of pieces, and requires a subset of those shares to reconstruct the original. Take your master password, split it into 10 shares, and require 5 shares to reconstruct. Then distribute the 10 shares to secure locations and trusted people.

Example:

Password: 12345
Share 1: 801650d0edcbd0c3c949f
Share 2: 802c91a40a532182e3570
Share 3: 803ad177a79bc1420a1de

Any 2 shares can reconstruct the password.

And the site runs entirely in Javascript. You can save it to a USB stick and run it from an offline PC, so you don't have to worry about your password being stolen.

I Use a Password Safe

[fast turtle]

and have hard copy of the Password in a fireproof safe at home. This way if I'm hit by the bus, struck by Lighting or any other reason, so long as I'm able to function, I can recover all of my passwords.

Hell I've been using a password safe for a decade - started with a freebie from PC Mag called Passes (included the source code) but I've replaced it with Passkeeper due to cross platform support so I haven't written anything but a single PW down in a decade.

Re:Secure safe.(Shamir Secret Sharing)

[kye4u]

Use Shamir's Secret Sharing . That way ordering doesn't matter. You just need the N secrets.

Re:Man, You Guys Miss The Point

[jasper160]

You might not even remember that you have had a particular account. Or who you are

My mother in-law had a stroke a few years ago had her memory severely damaged. Luckily for my wife the old OCD woman had documented every account, web site, password, recovery word/phrase, and pin. My mother in-law instructed my wife to contact her attorney if anything debilitating occurred since he kept the document at his office and was instructed to give the envelope to my wife in that situation. We adopted the same idea as it seems to be the easiest way to do this and we don't expect our small children to be able to reconstruct a password in the event of us getting schmucked on the drive home. Sorry Shamir.

Not a new problem, so why the new question?

[holophrastic]

cognitive disfunction is a thing that's existed for centuries. Amnesia counts. So who's going to care for your children in the event that you don't remember how to make breakfast?

Oh right, you have a will. It can be executed in whole or in part.

Stop pretending that new problems need new solutions. We have old solutions that work damn fine.