Is there some flaw in this approach (besides requiring trust in the family members)?
I learnt the hard way this week that my recovery code for 2fa with github does not work. The second factor turned out to be the only available way for me to sign in and it looks like I've lost the account. Passwords be damned I guess.
In this case it's mildly annoying but it has forced me to reconsider that backups and instructions to access passwords are no longer sufficient.
My next of kin should be able to sign in using their own credentials (even if just ID card), and not have to impersonate their dead relative.
Most places have death indexes, and death documentation.
1. Get them to use a password manager for their stuff. This can easily be a good idea all on its own, simply so that they don't reuse the same credentials everywhere.
2. The password store can be decrypted with either of two methods: A day-to-day password they memorize, or a longer key which can be stored along with the will. [1]
3. Set up the cloud services to automatically backup and share their encrypted at rest password store from their computer to various relatives and friends.
4. Take the alternate encryption key from step #1, print it on archival paper, seal it inside an opaque tamper-resistant envelope, and store the envelope along with the will--or in such a way that it reaches the right people when the person passes away.
This way they can easily keep things up-to-date with new accounts or password changes, without constantly sending new stuff to a lawyer or safe-deposit box or whatever.
_______
[0] An archetypal relative who is "not good with computers."
[1] This isn't algorithmically impossible by any means, but it's a use-case not all password managers will support. An alternative is to tell them "never change your master password ever", and then just duplicate it in the sealed envelope.
Could it be left with their attorney? Not really - the attorneys don't want the paper and don't want the additional responsibility for keeping it secure. Plus having to make it available at their office for recording occasional password changes.
More than half the reason I implore my parents to digitize their ink-scrawled Sheet Of Login Stuff involves having an off-site backup. Leveraging it to help with end-of-life planning is just a bonus.
The longer key is kind of pointless given the shorter password, unless that shorter password only works with a hardware key.
Also, for bonus disaster-preparedness: When setting up the cloud service to backup+share the encrypted file, also include the original installer for the password-safe software. It avoids the problem of trying to find code from a discontinued software project or which successor-project may or may not compatibly open the file.