Just being aware of the risks and counters helps a lot.

Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.

The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.

At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.

Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.

how do you do this, any hints?

I use LastPass’s Emergency Access feature for this.

You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period.

There are written instructions for my next of kin on what to look for in the Vault.

The main difficulty is if my next of kin forget their LastPass master password.

I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.

One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.

Even users who know how generally fail to properly store, transmit, and authenticate key material.

https://youtu.be/9k4GP3Evh9c

It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox.

It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload).

I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.