Could Anyone Else Actually Open It?

Existence and access are separate problems

Knowing that something exists tells you what to look for. Being able to open it is what lets you do anything. Households that have solved the first frequently assume they have solved the second, and the two have almost nothing to do with each other.

The distinction has become sharper over the last decade, because records that used to be paper in a drawer are now accounts behind a password, and a drawer does not have a password.

So the useful question is not where things are. It is whether a specific other person, using their own device, could get into them today.

The four places access quietly concentrates

• A password manager only one person can unlock, which is the most complete version of the problem.
• A phone number used for verification codes, which belongs to one person and is frequently the only route in.
• An email address that receives everything and which nobody else can open.
• A physical item, a key, a safe combination, a device, held by one person and not duplicated.

The second is the one households almost never think about and the one that most often blocks everything. A verification code sent to a phone nobody can unlock is a locked door with the key inside.

The test, which takes ten minutes

A conversation about whether somebody could get in is not a test. Actually trying is, and it produces a different answer surprisingly often.

1. Pick the person who would actually need to do this.
2. Ask them, unprepared, to open the household's list of what exists.
3. Ask them to open one account on the list, on their own device.
4. Note where they get stuck, which is usually at a verification step rather than at a password.
5. Fix only what the test found, which is normally one or two things.

The value of doing it rather than discussing it is that the sticking point is almost never where either person expected. Households consistently guess password and consistently find it was a code sent somewhere else.

It is nobody's fault and it is everybody's problem

Access concentrates because one person set things up, and setting things up is a favour rather than a failing. Nothing about it is careless.

But the household has quietly acquired a single point of failure that nobody chose, and the only way to find out where it is, is to test it while everything is fine.

What good looks like

Not sharing every password, which is neither necessary nor wise. Three things, and they are much smaller than the problem sounds.

The third is the one households skip and it is the one that covers the situation where both adults are affected at once, which is unlikely and not impossible.

Where this differs from knowing where things are

The companion problem, where a record physically lives and whether somebody hours away could reach it at all, is covered in keeping family records reachable across a large state. That is about distance. This is about permission, and a household can pass one and fail the other completely.

In practice most households fail this one and pass that one, because filing is a habit and access is not.

The moving household version

A relocation is the point at which this gets worse and the point at which it is easiest to fix. Everything is being reset: new accounts, new addresses, new logins, frequently set up in a rush by whichever adult had the afternoon free.

That afternoon determines who can open things for the next several years. Spending twenty minutes of it making sure both adults can get in is the least effortful version of this work there is.

It belongs on the wider list in what changes when a family is newly in one state.

None of this helps if nobody knows the index exists, which is a separate step and is covered in telling your family what you have arranged.

What not to do

Two things, and both are common attempts at solving this that make it worse.

1. Writing passwords into the same document that lists what exists. That converts a harmless index into something genuinely damaging if it is seen by the wrong person.
2. Sharing everything with everybody, which produces an arrangement nobody maintains and which nobody can later audit.

The workable middle is that the index is open and the credentials are not, with a separate and deliberate arrangement for the credentials that one other person knows how to use.

Why this got harder without anybody deciding it

A generation ago household records were paper, in a house, and anybody who could get into the house could read them. Access and location were the same problem, so solving one solved both.

What changed

Statements moved to accounts, accounts acquired passwords, and passwords acquired a second step attached to a device. Each of those was an improvement in security, and each of them narrowed the number of people who can reach anything from several to one.

Why it is not visible

Because nothing broke. The household still holds everything, still knows where it is, and still uses it every week. The narrowing happened one setting at a time, and no single step was worth mentioning to anybody.

That is the argument for testing rather than thinking. A problem that arrived invisibly will not be found by reflection. It will only be found by trying to open something.

Mistakes worth avoiding

1. Assuming access because the other person knows the arrangement exists.
2. Testing by asking rather than by trying, which produces a confident and wrong answer.
3. Solving the password and ignoring the verification code, which is where most tests actually fail.
4. Fixing everything at once, which is a project nobody finishes, rather than the one or two things the test found.
5. Never repeating the test, when accounts change their verification arrangements without asking anybody.

The household did not decide that one person would hold everything. It simply happened, on an afternoon nobody remembers.

What this does not require

It does not require a system, a subscription or an afternoon. It requires ten minutes, one honest test, and fixing whatever the test found. Most households discover the whole problem is one phone number.

The version where nobody in the household can act

Uncommon and worth thirty seconds of thought, because it is the case the household's own arrangements cannot cover by definition.

The answer is not to give anybody outside the household access to anything. It is that one person outside it should know that an index exists, roughly where, and who would be expected to use it. That is a fact rather than a permission, and it costs nothing to share.

Households that have done the rest of this and skipped that step have built something that works in every situation except the one that would need it most.

Doing it without a system

Households frequently conclude that solving this properly requires adopting some piece of software, and then do nothing because adopting software is a project.

It does not. The minimum version is that a second person can open the index and can receive whatever verification codes matter, and both of those are usually settings on things the household already uses rather than anything new.

A shared account for the verification address, or a second number registered where one is allowed, covers most of it. Neither requires anybody to change how they work, and both can be arranged in an evening.

A reasonable next step

Run the ten minute test this week, on one account. Whatever it finds is the entire job. The wider context is funeral cost planning for Texas families.