Hacker News Reader

Comment by fourmajor | Hacker News Reader

Yes, I have set this up to give my wife access after 14 days: https://www.lastpass.com/features/emergency-access The long delay is simply for security purposes so there's not instant access for someone who hacks _her_ accounts.

> Give someone you trust access to your vault. When your trusted contact requests Emergency Access, you can decline their request within the specified waiting period. Otherwise, your vault is added to their LastPass account.

View on HN

Are there any technical details of how this works on the backend?

I thought LastPass only kept encrypted user data that only the master password can decrypt. Would this process mean they keep an accessible copy?

I suppose the process could be to encrypt my master password with a public key generated by the spouse account (with the private key stored in their encrypted bundle), that LastPass servers can store and provide on delayed request?

I would imagine it involves something like encrypting your master password (or more likely some other encryption key that won't change) with their master password as if it were anything else they had stored in their account. The difference is that it's blocked by the time delay.

I think something like that might be how it's done. I don't think they could use the master password directly (at least I hope not, wouldn't that mean transmission of a master password from the client?), though I suppose they might have a mechanism of generating a consistent key pair just from the master password.

However it works, I think LastPass should have a technical section that describes the mechanism in more detail

LastPass describes how it works at [1].

They also have a technical whitepaper describing a lot of their cryptography including shared folders and recover codes. I found the current version[2] which disables ctrl-f for some reason, and an older version[3] which allows ctrl-f.

[1] https://support.lastpass.com/help/how-is-emergency-access-se...

[2] https://support.lastpass.com/download/lastpass-technical-whi...

[3] https://assets.cdngetgo.com/da/ce/d211c1074dea84e06cad6f2c8b...

I believe, when you set this up, they re-encrypt your data with the other user's keys so it's never accessible by Lastpass.

I think the problem with that would be the copy would go stale fairly quickly right? I suppose the process could make it so the data set is encrypted with all associated keys everytime it's uploaded from the client

Shared key.

You have a key, which encrypts a shared key.

Your spouse has a key, which encrypts the same shared key.

Vault is encrypted with the shared key.

Access is controlled separately. But upon successful share, their existing key can decrypt the shared key which decrypts the vault.

The real last pass!

Bitwarden has this feature too.

Where?

https://bitwarden.com/help/emergency-access/

requires premium or self-hosting. But it doesn't expire if you stop paying.

Reply on news.ycombinator.com