Life insurance for your passwords: Legacy Locker
Jeremy Toeman is unveiling on Tuesday a simple, clever, and very different kind of backup service.
Legacy Locker simply backs up the passwords and access codes to your online accounts. When you die, it gives that information to the people you designate.
I got this concept in half a second: if I go, I cannot imagine the trouble my wife would have trying to untangle my financial and e-mail accounts and deal with my contacts on my social networks, not to mention controlling the disposition of some online assets I own, like domain names.
The idea with Legacy Locker is to give your survivors easy access to your photo, blog, social network, e-mail, and other personal online sites so they can figure out what to do with the info and files stored there. Or, possibly, so your survivors can reach out to your followers or friends to let them know what's happened to you.
You can include financial accounts in your Legacy Locker file, although as Toeman reminded me, the rules of what to do with financial assets in the event of an account-holder's death are already established. You have responded to your bank's request to fill out a beneficiary form, haven't you?
Now, sure, you could easily do all of this for free by writing down all your codes and instructions, and putting that information in a safe or the hands of a family lawyer. Legacy Locker offers more fail-safes and features than a slip of paper, though. It can also distribute different access codes to different people.
The system periodically tries to log on to your accounts for you. If it can't--if you've changed passwords--it alerts you to update your records. Also, Legacy Locker only unlocks if two people whom you've designated confirm your death, and even then only if one of them supplies a death certificate to the company. Legacy Locker staff handles this; the unlock procedure is not wholly automated. Toeman claims that the system's files are all encrypted and cannot be unlocked without authorization.
You can set up your account to send out farewell letters to people you designate (or post items on sites per your instructions), if you die. The product also has a form of living will, an incapacitation mode (I call it, "coma mode"), that will turn on autoreplies and otherwise idle your accounts, without sending out your goodbyes.
Consumers will be able to buy Legacy Locker directly, for $29.99 a year or $299.99 for a lifetime subscription, but the company's real plan is to sell this service through estate planners. There are 35,000 of them in the United States, Toeman said, the ones he's contacted seem eager to resell this service to their customers.
Legacy Locker is morbid, but smart. It's scheduled to go live in April.
Related: Taking passwords to the grave.
Rafe Needleman writes about start-ups, new technologies, and Web 2.0 products, as editor of CNET's Webware. E-mail Rafe. 
Looks like a great idea, though!
They seem to have thought every detail through...they deserve to be successful.
I like the password checking mechanism, but it kind of freaks me out that an external system is accessing my financial accounts.
The only reason why you should not use this service is that you may as well say bye-bye to security. This would be a weakest link in the security chain, and of course the one that matters.
Quote:"Now, sure, you could easily do all of this for free by writing down all your codes, and instructions, and putting that information in a safe or the hands of a family lawyer. Legacy Locker offers more fail-safes and features than a slip of paper, though."
Response: A piece of paper in the hands of the family lawyer (or, perhaps in a safe deposit box(es) with the key(s) given to a relative(s).
Why? Because the deposit box will not be targeted by attacks of script kiddies, and more serious guys. Your lawyer will not be bombarded with random attacks of an unsocial teen with plenty of time on his hands. Nor will they (bank or the lawyer) "accidentally release information" or experience "security breach" that often. No offence to modern technology (i am in IT field myself, and deal with security in financial world quite a bit).
It's the same thing as storing all of your passwords in an online repository.
Yes, "Our opinion was that this level of security was not sufficient, so we added 256-bit encryption based on multiple 512-bit hash keys on all information being passed through 256-bit encrypted secure socket layers (SSL), which is encrypted over a thousand times before being stored in our maximum security databases in its encrypted format." It's great that they know all these number-based terms, for those who seem impressed by them, or feel dizzy, here is a short explanation: they are referring to length of the key. And for the record, AES256 encryption is more than enough to withstand a brute-force attack(password guessing) for longer than anybody would live. The problem is that usually, it's not the encryption that fails, it's another link (human error, or code bug)
System is only as secure as the weakest link.
I haven't even looked, but I'll put money on the fact that there will be disclaimers that absolve the company of any damages should they "inadvertently" lose or make public all your data.
That itself is just another form of key management, so what are we offering here? Outsourced key management?
-R
"Toeman claims that the system's files are all encrypted and cannot be unlocked without authorization. "
Why does that sound really contradictory....
I've never used KeePass but that's an option too. Make sure your family knows where the master key is.
uh-huh.
I'm not one to shoot down others' business schemes, but this looks rediculous. And quite possibly disasterous if their servers get comprimised.
Unless the Catholic Church starts a password storing company, I wouldn't use this. Or your wife starts a password storing company. :)
BEFORE I even read the article I clicked on the link to their website to check for
Extended Validation SSL... and there was the bright green url with the certificate
issued in in Jan 2009, expires in 2010.
Well, you have to admit it adds legitimacy right off that bat.
If nobody can unlock the customers information but the customer, how does it get the passwords to occasionally log into one's accounts ?
- by federico001 September 22, 2009 2:59 PM PDT
- hey
- Like this Reply to this comment
-
(16 Comments)