Mark Loveless, aka Simple Nomad, is a researcher and hacker. He frequently speaks at security conferences around the globe, gets quoted in the press, and has a somewhat odd perspective on security in general.

Alone

Alone

West coast of Ireland, 2006. Photo by Kimberly Loveless.

For the first time ever in my life, I live alone.

The entire time growing up until I got married, I lived with either family or at least one roommate. After being married for 35 years, my wife Kimberly passed away on November 1st in 2021 and I found that it was just me. I'm adjusting as best I can, and will eventually get through this obvious rough period.

But the main thing to discuss here today is some of the "digital" impact of a loved one's death. You see, my wife had known health problems which we had discussed at length many times, and yes we had worked out a lot of preparations well before her passing. Many things such as memorial service vs funeral vs burial vs cremation are common things one works out. Things like dealing with bills, a spouse’s name on property or bank accounts are also fairly well documented for people to figure out even with little to no plans. But the whole digital side was a challenge.

Core Technology

My wife's main pieces of communication technology were her laptop and and her iPhone. When I say core technology, I mean the tech that talks to all of the various accounts. As a result, many of the things needed were passwords to her dozens and dozens of accounts online, and having a lot of them cached in phone apps and a web browser just made things that much easier for her to access them.

She did a lot of online shopping and preferred to buy direct from small businesses instead of major retailers when possible. She typically started holiday shopping as early as February, and accumulated new online accounts over the years. As a result she had well over 165 online accounts for retail shopping. Between those 165 accounts, streaming services, doctor office “portals”, insurance, banking and other financial services - every one of them with a long and uniquely complex password - it came out to around 200 accounts. Most were written down in one of those password books in case of a laptop failure as she didn’t like password managers. Major passwords, such as banking info, all social media sites, her laptop password, and the 6 digit pin to get into her phone were not written down.

A note - privacy was deemed important in our household. My wife and I never shared passwords for our respective "major” accounts, and we never shared passwords to our respective phones or laptops. When we still had kids at home, we never asked for their passwords to anything either. And now that approach was going to come back and bite me. Hard.

Gaining Access

I'm the ISP for the household, and the mail server is located here in the house. So basically any account’s password reset that involved her email would allow me to gain access. Access to her laptop was easy enough, as she ran Windows 10. Yes it was fairly locked down, but it was Windows 10, so I was able to gain access to that within minutes.

The Browser

She used Firefox, and fortunately she had cached social media and banking passwords in the browser (this is not recommended, but at least she had two factor enabled). I was able to download all of her Facebook data, which I knew covered the vast majority of photos and videos from her phone, and many other more private photos and videos had been shared with friends, who in turn shared them with me. Between the browser, the password book, and her email, I was able to get almost everything properly adjusted. Many things were easy, as most things like streaming services were tied to just an email, and changing the name on the account was simple.

Social Media

I designated myself as her executor in her Facebook account, and I started the process of contacting Facebook via my account to memorialize her account. Of course the process has not been smooth, and after three attempts at requesting the memorialization and help from friends who are employed at Facebook, still nothing. As of this writing it has been six weeks since the first request and I don’t seem to be any closer. Other than Facebook, no major issues with social media**.

Apple Technology

My biggest concern was her contact list on her Apple iPhone 12 Pro Max, along with any pictures or videos on there.

Like I said earlier, the phone was protected with a passcode I did not know. I had tried the usual ones I thought it might be, but that just started adding up towards the 10 tries before the phone was wiped. Facial recognition had been turned off for a couple of reasons. First, every time she picked up the phone it would unlock if she glanced at it. Second, she stated that someone could take her phone from her and hold it up to her face to get it unlocked. The latter is obviously an extreme case, but her fear was in case she was protesting or some other related activity deemed “subversive”, a law enforcement agency holding up her confiscated phone to her face could gain access.

Her notifications did not preview, they just included minimal metadata. This meant any two factor involving SMS would not work without a SIM relocation. I was able to reset her Apple ID password from her laptop and selecting a voice call verification since I could at least answer the automated voice call and get the six digit number, but that was about it.

With her Apple ID password reset, I was able to get into her iTunes on the laptop.

I found a backup of her phone via iTunes on her computer, but it was dated late 2019. It was a password-protected backup, but she did write down the password (I found it at the bottom of a desk drawer on a Post-It). That said, it still meant roughly two years worth of media was possibly lost.

She had said she didn’t like iCloud and didn’t want Apple to have access to her photos, videos, and contact list. But I went ahead and logged in to her iCloud account with her Apple ID. Instant relief - she had been backing up her contact list, photos, and videos to iCloud since that 2019 iTunes backup, the last one was just a few hours before we ended up heading to the hospital ER that last fateful time.

Between the backups on her laptop and iCloud, I finally had everything of value off of the iPhone without gaining access to it. I could at this point just wipe it.

My Own Death

I’m going to be detailing out the process for access to all of my digital data in the event of my passing (in addition to a will). It will be both physically and digitally secured and my heirs (who do not have access to it yet) will know how to get to it. Full instructions on how to access everything, including warnings like to not access my bank account (technically it’s illegal) will be included. I may even create an edited copy of this personal information to be published after my death for the morbidly curious - or at least for some major nerd death entertainment.

Conclusions

A will would have helped. Filing paperwork for insurance, car titles, deed to the house, canceling and transferring banking info to new accounts (yes that’s how it is done for shared accounts*) is a painful process indeed, but these paperwork processes are well documented and the organizations involved are used to dealing with it.

Modern technology is a different story. Most online sites have no plans to handle the death of an account holder, or the process is obscured behind layers of people, references, and an ever-changing platform landscape (looking at you, Facebook). This is a major area of concern, and one to seriously consider documenting as thoroughly as possible.

If you want to keep your secrets safe after you die, apparently having them on an iPhone with no biometrics active and a non-disclosed pin code is a great start. Hats off to Apple’s security model, I believed in it before, I certainly believe in it now. I was lucky I was able to gain access to the photos, videos, and contact list. It wasn’t everything on the phone, but everything I wanted to get to.

Knowing a person’s last wishes in advance is a huge help, so many questions were already answered with our various discussions. I hope me relaying my experience turns out to be helpful for you, and can help in planning for these things in your family.

* Edit 2022/01/07 - This applies to some forms of joint accounts. Many joint accounts still have a “primary”, and this is often dictated by state law. In our “joint” accounts we opened decades ago, I was apparently the “primary” as the male in the couple, which yes, is fucked up (thanks, Texas). Had I passed away before my wife, she might have had to close and reopen one or more accounts. Ask your bank for specifics.

** Edit 2022/01/15 - After help from a friend that is a Facebook employee, Kim’s Facebook account was finally memorialized. It took my friend several attempts as well.

Kim on October 10, 2021. Photo by Natalie Keeton/Wondery Photography

Urban EDC Kit

Urban EDC Kit

Daemon

Daemon