Emergency Access only upon death feature?

Feature name

Account handover to another when inactive for a period of time.

Feature function

Gmail has a feature where if you don’t log in for three months your account can be turned over to another. This would be a crucial feature for a password manager. When I die I would like my wife to have access to all the sites I use. I don’t know if this is technically possible but it would be a really great feature.

I wouldn’t do that.
That way they may get to know you master password. They may access your account without your knowledge and:
At any time, they can access you account immediately without you having a chance to stop them.

That’s why I would do something else:

  1. Make a new (free) account
  2. Give that account emergency access.
  3. Split that master password in as many parts as you like and give them to different people.
    That master password has to be long enough and shouldn’t be related to yours.
    For redundancy, you also can give the same part to different people and everyone needs the email address.
1 Like

The regular emergency access Bitwarden has is similar Tim. Here’s a link describing it: Emergency Access | Bitwarden Help & Support

1 Like

Would be useful to also be able to mark certain items as mine only even after death and emergency access. I wouldn’t want my family members coming across my “adult” accounts in my vault :rofl:

4 Likes

Look up Shamir’s Shared Secret. It’s a way of cryptographically splitting up a secret S into N parts but only any K pieces (K<=N) are needed to reconstruct the secret S. (BTW, Shamir is the S in RSA.)

Use it to split your master PW into enough pieces to give them to all your trusted people (including a lawyer?), but only K of them would need to get together and agree to present their piece to come up with your master PW. If K=N, then everyone would have to agree together.

2 Likes

While not a solution to the issue of not wanting to bring it up beforehand, which is less a technical issue and more a social one, a possible solution to not wanting to provide access until death would be to follow the normal, current process, but once the emergency access is granted and the emergency user has a password set up, have that password disabled entirely, i.e. they can’t even try to use it to access the account and trigger the notification to the account owner, until one of two things happens (either an option or just whichever the developers determine is the best solution):

  • A certain amount of (ideally user-configurable) time has passed without access to the account, at which point emails (again, ideally the number and timespan, i.e. 3 every week, so once a week for 3 weeks, would be user-configurable) would be sent to the account holder notifying them the emergency contact will soon be notified they can request access. Once that total time has passed without response by the account owner, the emergency contact will be notified, and they can request access and wait for approval, denial, or no-response default approval as is currently the setup. This is basically like Gmail’s inactive account setting, only with the need to set it up ahead of time with the emergency contact.

  • Do the same as in the first solution, having an emergency contact set up a password which is disabled until activated later, only in this case the method of activating it is different. In order for that to happen, an additional one or more passwords or keyfiles need to be used to activate the emergency user’s password (or, in other words, for their password to work to access the account), and these could be given to lawyers, other family members, etc. This is just one more reason why keyfiles should be added to Bitwarden as requested here. In fact, this solution does deal with the issue of not wanting to discuss this ahead of time with family, as the emergency user can be a lawyer and the additional password(s)/keyfile(s) can be given to family, (an)other lawyer(s), kept in a safe place, etc. Something as simple as a keyfile or secret password can really open up the possibilities for dealing with this.

Various social media and webmail platforms have a feature that periodically reminds their users every X months that their next-of-kin disclosure or data auto-deletion service is active. For example, Dropbox auto-deletes all data if a user hasn’t used the service in X months. Google has a service called “Inactive Account Manager” and a support section called “postmortemrequests@”.

In general interests of privacy, a fair GDPR-type policy would be someone should have the right to be forgotten, data deleted, and/or data handed down to next of kin. The current situation of cookies and data export are half measures.