11–20 of 101 posts
Earlier quoted context omitted.
Not even just the code....your password and email are both over http.......
The form action for login appears to be https, but not the code... I don't know why people bother not just httpsing everything if they have the cert. It avoids these types of worries and appearance.
Hmm I don't like the idea of involving a third (untrusted party) with what could be basically the key to your whole online identity. I would love to see a system which allows your heirs to access online accounts without having to fear that a simple government request will hand them everything they need on a silver plate (including stuff not obviously related to you). Probably physical objects need to be involved (cod…
Just run this service for a few years without actually encrypting the data, then charge $20/month to NOT release the information.
This is an idea that has been around in various forms for a number of years. A number of other sites have popped up but like a number of people have already said, I don't trust random third parties with the keys to my online life.
Yet it's a problem to be solved.
Obviously it's still a problem, but the problem isn't just "I need someone to do this stuff if I die". Rather it's "I need someone I can trust absolutely to this stuff if I die.
By trust absolutely I mean:
* will not abuse it.
* Will not even look at the data I submit and can guarantee this.
* will not get hacked and/or can guarantee my data's security if they do get hacked
* won't get bored with this hobby. Which leads to:
* will be there in 1, 10, and 50 years - or can 100% guarantee orderly step down if they don't make it.
* what if their server is down or under DDoS when I try to confirm my living state?
* What if I can't get to a system and miss multiple emails?
Domain is freely available again, I gave up on the project and rolled the useful code into something else.
This is an idea that has been around in various forms for a number of years. A number of other sites have popped up but like a number of people have already said, I don't trust random third parties with the keys to my online life.
In the event anything happens to you the other key is sent to those people allowing them to decrypt it.
Service can't access your data as it only has one and same for trusted person.
I'm sure something like this already exists (and tbh the level of effort required to set it up pretty much makes it unlikely to catch on) but it is theoretically workable.
This particular implementation transmits sensitive data in the clear and does the encryption server-side, so it's hard to take it seriously except as a remote (and unsecure) notification service.
Aside from that obvious shortcoming, a truly secure and reliable DMS system would need the following properties, possibly more:
1. All data encrypted client side and sent to system only in encrypted form
2. Anonymous
3. Distributed (no single point of failure for DDOS attacks or subpoenas)
4. Any data sent into the DMS system is split into several pieces and only reassembled after the set time without a response has elapsed and the switch is triggered
A peer-to-peer application that transmits data exclusively via TOR would probably be most secure, but it's unclear what the motivation for running an instance of this kind of P2P application would be (since it's all encrypted you aren't downloading anything useful) or how many people would actively participate. Any server-based system would need to have a large number of servers in multiple countries to be robust to technical and legal challenges, and that sounds expensive. At the same time, a reliable and anonymous DMS system is something that I can see people paying a small subscription fee for.
Any way you slice it, it seems like there are a lot of hard problems to solve in this area, but a reliable DMS service would be extremely useful.
Hmm I don't like the idea of involving a third (untrusted party) with what could be basically the key to your whole online identity. I would love to see a system which allows your heirs to access online accounts without having to fear that a simple government request will hand them everything they need on a silver plate (including stuff not obviously related to you). Probably physical objects need to be involved (cod…
Hmm I don't like the idea of involving a third (untrusted party) with what could be basically the key to your whole online identity. I would love to see a system which allows your heirs to access online accounts without having to fear that a simple government request will hand them everything they need on a silver plate (including stuff not obviously related to you). Probably physical objects need to be involved (cod…
Probably physical objects need to be involved (code on paper etc) but then again how to make sure the next best burglar doesn't get the prize of his lifetime. Does anyone know of such a solution? Put it in a safe deposit box at your local bank?
All my online logins are long random passwords stored in either 1Password or my phone. I've considered writing up my password (to 1PW), and computer unlock PW, and dropping it in my safe deposit box, updating it monthly or whenever I change those passwords.
Any good reason not to?
There's an endless number of possibilities as to what could happen in order for me to not be able to go online and verify with that link. Why would I put myself through the stress of potentially forgetting and now I have to worry about the secrets of my dying breathe being released to the public while I'm still around.
If I wanted anything to be taken care of I'd feel much safer keeping it in offline storage with a note attached.
What I think you should do is have a tiered level of notifications. For example an email every week is the first round of notifications. Then I wonder if you could pull my last login info from major services that are going to be around for awhile like Amazon, Google, Apple, Facebook(debatable), and if I havent logged into any of those services in 1 week, then go to the final round of notifications which is an in-person phone call.