#2713 Dead Man Key

[Ken]

What is the best way to share a KeePass password for use in the event of my death?

One solution I had in mind was to enhance the header to permit the storage of multiple unlock passwords. LUKS does this: it provides 8 slots for password keys that can unlock the master key. I could then use one slot for my day-to-day password (which might change over time any any time it felt compromised) while I use another slot for a secure recovery password which I write on a piece of paper and keep locked away in a trusted place (potentially an inconvenient place to access) - such as a sealed envelope with a trusted friend. The latter would allow my surviving family to open my KeePass database and have easy access to all my latest financial information and instructions. The goal would be for the Dead Man Key ("DMK") to rarely need updating while the day-to-day key can easily be updated.

An enhancement to this solution might include a M-of-N DMK/recovery password whereby it is divided across [4] trusted people/locations, any [2] of which can unlock the file.

Other ideas welcome.

Thanks,
Ken

[Paul]

There will not be multiple keys. That is a back door by another name.

Print an Emergency Sheet (File > Print), fill it in and save it with your will. You could print 2 or more with part of the password each.

cheers, Paul

[Dominik Reichl]

There already are feature requests for multiple users/keys and secret sharing, i.e. this is a duplicate.

However, for your scenario, I'd recommend what Paul suggested.

Best regards,
Dominik

[Ken]

Thanks. And to be clear - if I print the "Emergency Sheet" this recovery data will never change - even if I subsequently change the password/keyfiles to the database?

[Paul]

The ES is a copy of your encryption settings. If you change those settings you need to update the ES.

Print one to PDF and see what it does.

cheers, Paul

[Ken]

I do still wish this "back door" of a second password could be made available as a code I can hide away in a safe place to be used after death.
In the meantime I may start looking at this: Proton Drive has released an Emergency Access feature. This looks to be a good way to create a stable long-term backup access for family members to access file (or Proton Pass) in the event of death.
https://proton.me/blog/emergency-access

[Paul]

To manage changing credentials split the password up using Shamir's Secret Sharing and give the parts to trusted, or not very trusted people. If you change your password, send new codes.
The Simple Shamir's Secret Sharing site has a nice implementation that you can use.

cheers, Paul