I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.

Searching for best practices didnt help so far. Thats why I turn to you.

So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.

Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.

If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.

Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.

Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?

Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes

  • LostXOR@fedia.io
    link
    fedilink
    arrow-up
    2
    ·
    edit-2
    7 months ago

    You could encrypt the backup codes with a strong password using something like AES, then print the encrypted data out in hexadecimal or base64.

    • astrsk@kbin.social
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      7 months ago

      Honestly this would make for a neat project — build an esp32 or rp2040 based punchcard reader / printer and then print out all your backup codes (encrypted of course by some hardware based code like a set of dip switches) onto custom punchcard tape.