I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.

Searching for best practices didnt help so far. Thats why I turn to you.

So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.

Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.

If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.

Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.

Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?

Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes

  • SterbenDeathGun
    3·
    9 months ago

    I use Proton Pass and Ente Authentication (2FA).

    I can’t access my Proton Mail without my 2FA, additionally I can’t even access my 2FA without my email address (verification code is sent to my mail to unlock my 2FA codes + I need the master password). If i lose one of them I am screwed you would say, but it’s not the case.

    What I did is to write down my Proton Mail Password and its secret code for 2FA + My Ente Authentication credentials (mail + master password). This way I will always be able to access my Proton Mail, even if i lose access to my 2FA app.

    This is the worst case scenario, i also have a second phone where i keep Proton Pass and 2FA logged in, so if I lose my main phone, I am not completely locked out.

      • SterbenDeathGun
        2·
        9 months ago

        I forgot to mention it, i use Aliases for everything, even my 2FA has one. This is basically hack proof, because they will never know the true email address (if they get the hand on my alias) where i receive the verification code. 👍

        The only way they could steal your data is if they hack in your smartphone, or if you connect to shady Wi-Fi. Stay Safe Boys!