I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.
Searching for best practices didnt help so far. Thats why I turn to you.
So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.
Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.
If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.
Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.
Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?
Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes
Totally agree with you. NEVER ever have your TOTP inside your password manager, most people overlook this small detail.
One thing you can do is export all your TOTP secretes / QR codes to some cold storage medium, like a flash drive, encrypted in some way and store that safely somewhere. To be fair, even if you don’t encrypt that flash drive since it is offline you’ll be safer.
Pretty awesome insight. Thanks. Do you happen to know any books about security philosophy so to speak? I mean best practices in cybersec but mostly how to think about ideas and how to implement those in business and or at home?
Not much to be fair. The majority of works on that field are simply bullshit written to sell frameworks and ideias that will lead enterprise customers to buy overpriced “solutions”.
Matches what I‘ve seen so far, sadly.
Maybe we should look for literature on common sense, may be more productive than those about security. At the end of the day most security is indeed about common sense and about picking the simplest approach to complex problems. Reading into general “physical / property security” also provides good insights for digital security.
Good suggestions imo! Thanks! Will do.