Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden releases “emergency access” feature

bitwarden.com

Post reply on HN
Print view View original

21–30 of 154 posts

Re: Bitwarden releases “emergency access” feature

#21

Post by toomuchtodo »

aunlead wrote: post #16

The pandemic has made me (re)evaluate how my family can get to my finances and online services. Such solutions can solve issues related to bank/trading account access and key documents but what about subscription services? All my subscription services from Netflix/Plex (less important) to VPN/Blackblaze (more important) are tied to my credit cards, which upon my untimely demise will be deactivated. My family will sur…

Everything should be documented. We have a binder with checklists that walk you through gaining access to everything the other partner might need in the event of death (email accounts, domain registrar, bank and brokerage accounts, auto/home/life insurance, ongoing recurring bills of all sorts). Bitwarden databases are exported to paper, 3 hole punched, and put in the binder on a schedule. Both partners get setup with each other's 2FA OTP tokens. Have options? Agreement goes in the binder. Own real estate? Deeds, land trusts, LLC agreements, etc related to this go in the binder. If in doubt, print it out.

Either one of us can assume responsibility for the entire estate in about an hour or so, the only delay would be a life insurance benefit payout. If you have assets that your partner might not know how to facilitate liquidity for, or when to, pay someone you trust to manage that. Your gift to your family is when you leave the world, they can continue on without fumbling to wrap up loose ends.

https://getyourshittogether.org/checklist/

Re: Bitwarden releases “emergency access” feature

#22

Post by alexanderh »

Barrin92 wrote: post #18

Bitwarden is just fantastic. It's open source, the interface is clean, works fine on all platforms for me and pretty much everything is free. If the devs browse here, thanks for making it.

How dependent is it on them as a service? If their website/service disappeared off the face of the earth tomorrow, would I still have access to my passwords locally?

I'm still hesitant to use any form of password management that relies on cloud services. I still like Keepass (with auto-updates disabled for security because their updater uses HTTP, of course), for my purposes. I can Sync my keepass file any number of secure ways that don't rely on a single provider.

Re: Bitwarden releases “emergency access” feature

#23

Post by bilange »

alexanderh wrote: post #22
Barrin92 wrote: post #18

Bitwarden is just fantastic. It's open source, the interface is clean, works fine on all platforms for me and pretty much everything is free. If the devs browse here, thanks for making it.

How dependent is it on them as a service? If their website/service disappeared off the face of the earth tomorrow, would I still have access to my passwords locally? I'm still hesitant to use any form of password management that relies on cloud services. I still like Keepass (with auto-updates disabled for security because their updater uses HTTP, of course), for my purposes. I can Sync my keepass file any number of…

> If their website/service disappeared off the face of the earth tomorrow, would I still have access to my passwords locally?

They provide a selfhosted alternative to their cloud service.

Not only that, there is a rust based birwarden server reimplementation that doesn't phone home (IIRC I believe the official self-hosted server needs an API key?), is compatible with all platform clients (at least for my needs). https://github.com/dani-garcia/bitwarden_rs

Re: Bitwarden releases “emergency access” feature

#24

Post by viraptor »

alexanderh wrote: post #22
Barrin92 wrote: post #18

Bitwarden is just fantastic. It's open source, the interface is clean, works fine on all platforms for me and pretty much everything is free. If the devs browse here, thanks for making it.

How dependent is it on them as a service? If their website/service disappeared off the face of the earth tomorrow, would I still have access to my passwords locally? I'm still hesitant to use any form of password management that relies on cloud services. I still like Keepass (with auto-updates disabled for security because their updater uses HTTP, of course), for my purposes. I can Sync my keepass file any number of…

Your passwords are cached locally on the devices. You can export your vault too. If their public service goes down (or if you don't want to use it in the first place) you can stand up your own server (there are at least 2 common implementations) and point your clients at it.

Re: Bitwarden releases “emergency access” feature

#26

Post by itake »

Barrin92 wrote: post #18

Bitwarden is just fantastic. It's open source, the interface is clean, works fine on all platforms for me and pretty much everything is free. If the devs browse here, thanks for making it.

I have been using Bitwarden for over a year now and there are still tons of UX bugs that annoy me.

In Firefox extension:

1. There is no memory. If you close the window, to copy the password, you have to re-search for the account to find the username.

2. If you open up bitwarden before the page is loaded, it says it can't find the password box to fill in. This is probably an extension limitation, but still annoying.

iOS

1. No memory. If I search for a username, I have to re-search for the password. It always opens up to the search screen (when I am using it via the password helper keyboard). 2. iOS the keyboard doesn't always show up to let me search for an account via password helper keyboard.

In general

1. You should be able to set a default username or email to automatically use when creating a new account. I hate having to type my email address in every time when creating the account on mobile. 2. When you're registering an account on a website, I first create it in Bitwarden with a password then I paste the password into the textbox to register the account. If the website rejects the password cuz of formatting, I gotta go back into bitwarden, edit and update the password with the new format. it takes like 5 clicks. ugh.

Thanks for listening.

Re: Bitwarden releases “emergency access” feature

#27

Post by legerdemain »

toomuchtodo wrote: post #21
aunlead wrote: post #16

The pandemic has made me (re)evaluate how my family can get to my finances and online services. Such solutions can solve issues related to bank/trading account access and key documents but what about subscription services? All my subscription services from Netflix/Plex (less important) to VPN/Blackblaze (more important) are tied to my credit cards, which upon my untimely demise will be deactivated. My family will sur…

Everything should be documented. We have a binder with checklists that walk you through gaining access to everything the other partner might need in the event of death (email accounts, domain registrar, bank and brokerage accounts, auto/home/life insurance, ongoing recurring bills of all sorts). Bitwarden databases are exported to paper, 3 hole punched, and put in the binder on a schedule. Both partners get setup wit…

In an accident or disaster (house fire, flooding, earthquake, you name it), this binder will be gone. This binder should be in a secret manager.

Re: Bitwarden releases “emergency access” feature

#28

Post by jjnoakes »

aunlead wrote: post #16

The pandemic has made me (re)evaluate how my family can get to my finances and online services. Such solutions can solve issues related to bank/trading account access and key documents but what about subscription services? All my subscription services from Netflix/Plex (less important) to VPN/Blackblaze (more important) are tied to my credit cards, which upon my untimely demise will be deactivated. My family will sur…

I don't do anything with my online accounts; for assets I rely on beneficiary information and my will, and I expect that the online accounts will just die off (as CCs close, etc).

I've always wondered if I should do more. What are the downsides of relying only on wills and beneficiaries? What might I be missing with this super basic estate planning?

Re: Bitwarden releases “emergency access” feature

#29

Post by Nightshaxx »

fhoxh wrote: post #9

This represents a dramatic escalation of side-channel attack vectors and surface area. It’s an unfortunate inevitability that this will not end well. Secure platforms never provide affordances for backdoors, especially backdoors tightly coupled to externalities. Bitwarden is further attracting unnecessary attention to itself from actors who have an interest in the collection of the volunteered emergency-trust relatio…

I disagree. This is an extremely important feature. If something happens to me, I wouldn't want my family to have to jump through insane hoops to get access to my accounts for a bit of extra theoretical security. At this point something traumatic has already happened to them and this would just be another emotion burden. This could be for financial reasons, or say if I were missing, to communicate with my friends.

Let people who don't need it and don't want it turn it off, but for me I'd definitely have it on.

Re: Bitwarden releases “emergency access” feature

#30

Post by jbverschoor »

ibejoeb wrote: post #10
NikolaeVarius wrote: post #4

Earlier quoted context omitted.

I have a similar and opposite problem. I would be fine with all my secrets dying with me, but what i want to protect against is me going into a coma/for some reason I forget how to access my accounts. How to securely manage it so that only I can open it if my biological self is there? I don't trust bank safe deposit boxes and I can't put a safe worth using inside my Apt. https://www.nytimes.com/2019/07/19/business/sa…

Perhaps just an old ipnone or android with a fingerprint sensor and another installation of bitwarden. You can keep the phone's passcode written down because its only use is to start the device. Then configure biometric log-in for bitwarden as an alternative to a distinct passphrase. In the event of a total blank, you should still have access as long as you retain a finger.

Requires a passcode before allowing biometrics
Post reply on HN