APPSEC Cali 2018 - Security After Death -- Not your problem, or is it?

### Overview In this presentation at AppSec California 2018, security auditor Tae Shipp addresses the challenge of managing and recovering digital accounts after death or incapacitation. Motivated by personal experience after the death of his best friend Eric Jacobs—whose widow needed assistance recovering account credentials to wind down his digital life—Shipp outlines practical security practices for managing extensive credential inventories, securely sharing sensitive accounts during life, and establishing resilient, multi-party master password recovery procedures.

### Key Topics - **The Modern Digital Estate Dilemma**: Historically, a death certificate, marriage license, or basic identity information was sufficient to settle bank and legal affairs. In contrast, modern accounts (such as Google, Facebook, and AWS) cannot easily be transferred or closed without account credentials. - **Password Managers and Vault Selection**: Storing credentials in human memory, physical sticky notes, or cleartext files introduces severe operational and security flaws. While single sign-on / "super federation" creates a single point of failure, dedicated password managers (e.g., KeePass, LastPass, Dashlane, Zoho) allow users to maintain randomized, unique passwords for hundreds of services behind an encrypted master vault. - **Credential Sharing and Vault Features**: In household and corporate environments, group sharing mechanisms and access tiers (such as "use only" options in LastPass) let users share access without disclosing cleartext passwords. Additionally, vaults can securely store sensitive artifacts including driver's licenses, passports, credit card data, and PKI certificates. - **Master Password Recovery via Shamir's Secret Sharing**: Relying on a single person or unmanaged master password creates a failure point. Shipp proposes generic secret sharing—specifically Shamir's Secret Sharing—to require multi-person collusion (e.g., 2-of-3 or 3-of-5 schemes) to reconstruct the master password.

### Technical Details - **Password Complexity and Length**: Shipp recommends generating randomized passwords of at least 20 characters for accounts without multi-factor authentication, avoiding human predictable patterns. - **Authentication Assurance Levels**: The talk references NIST authentication levels: NIST Level 1 (single-factor password), NIST Level 2 (one-time token generators like RSA and Google Authenticator), and NIST Level 3 (hardware tokens like YubiKey). - **Shamir's Secret Sharing Scheme**: Based on polynomial interpolation (published by Adi Shamir in 1979), this scheme breaks a master secret into multiple shards where each shard is no longer than the original input secret. Reconstruction requires reaching an established threshold (e.g., $k$ out of $n$), ensuring individual shards reveal no data about the secret on their own. - **Emergency Recovery Architecture**: An out-of-band recovery workflow involves writing emergency instructions, placing them in an encrypted ZIP file on cloud storage, splitting the archive's passphrase using Shamir's Secret Sharing, and distributing the shards and shared folder access among designated custodians. - **MFA Backup for Estate Continuity**: When addressing accounts guarded by Google Authenticator, Shipp highlights that photographing or backing up the initialization QR/GIF code into an encrypted vault preserves the seed and clock synchronization data, allowing authorized trustees to restore token generation on another device.

### Takeaways - Migrate away from browser-default unencrypted password saving, cleartext files, and predictable pattern passwords to a dedicated password manager. - Implement multi-factor authentication on all high-value services, backing up seed initialization artifacts inside the secure vault. - Create an out-of-band recovery system using Shamir's Secret Sharing with an appropriate threshold scheme to enforce dual-control collusion among trusted custodians, ensuring your digital estate can be cleanly accessed and resolved upon incapacitation or death.