I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.
Searching for best practices didnt help so far. Thats why I turn to you.
So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.
Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.
If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.
Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.
Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?
Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes
I’m no expert but I think the best practice is generally to keep the backup codes in a non-electronic format in a secure location, such as on paper stored in a fireproof safe or a bank’s safe deposit box. You wouldn’t forget that location. It’s not a cheap solution, though, and a safe deposit box limits you to the bank’s operating hours only. Using your backup code is typically pretty rare, though.
I would not use the TOTP offered by your password vault, though, especially if the vault backs up to multiple devices or the cloud.
Thanks for chiming in! Non-electronic and secure are going to be interesting things to consider, especially in combination.
Bank safe isnt totally out of the question but I would like to avoid them if I can. Second location wouldnt be impossible but offline doesnt mix in well with that since my family is a mess.
If one was to make a hobby out of this I can imagine peeps putting their secrets in plain sight but make them uninteresting for the uninitiated.
You could encrypt the backup codes with a strong password using something like AES, then print the encrypted data out in hexadecimal or base64.
Honestly this would make for a neat project — build an esp32 or rp2040 based punchcard reader / printer and then print out all your backup codes (encrypted of course by some hardware based code like a set of dip switches) onto custom punchcard tape.
Neat! Now we‘re talking! :))
Jk, but this is actually pretty cool.