I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.
Searching for best practices didnt help so far. Thats why I turn to you.
So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.
Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.
If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.
Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.
Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?
Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 84 users / day
- 537 users / week
- 1.5K users / month
- 6.58K users / 6 months
- 1 subscriber
- 2.32K Posts
- 54K Comments
- Modlog
I use two separate KeePassXC databases. One for passwords and one for TOTP. They are being synced on my devices using Syncthing.
Very awesome! I think we‘re getting somewhere on the „whats the best practice?“ thing. Having two separate databases isnt very hard to do but it is rather secure i suppose.
I use Proton Pass and Ente Authentication (2FA).
I can’t access my Proton Mail without my 2FA, additionally I can’t even access my 2FA without my email address (verification code is sent to my mail to unlock my 2FA codes + I need the master password). If i lose one of them I am screwed you would say, but it’s not the case.
What I did is to write down my Proton Mail Password and its secret code for 2FA + My Ente Authentication credentials (mail + master password). This way I will always be able to access my Proton Mail, even if i lose access to my 2FA app.
This is the worst case scenario, i also have a second phone where i keep Proton Pass and 2FA logged in, so if I lose my main phone, I am not completely locked out.
Pretty awesome setup! Thanks for sharing.
I forgot to mention it, i use Aliases for everything, even my 2FA has one. This is basically hack proof, because they will never know the true email address (if they get the hand on my alias) where i receive the verification code. 👍
The only way they could steal your data is if they hack in your smartphone, or if you connect to shady Wi-Fi. Stay Safe Boys!
Awesome! Thanks. The idea of only using aliases is pretty insane but also great! :)
removed by mod
Pretty awesome insight. Thanks. Do you happen to know any books about security philosophy so to speak? I mean best practices in cybersec but mostly how to think about ideas and how to implement those in business and or at home?
removed by mod
Matches what I‘ve seen so far, sadly.
removed by mod
Good suggestions imo! Thanks! Will do.
I mentioned this in a different post but I use both my password manager with totp as well as a YubiKey as authentication methods as I always have either my keys or my phone.
As for the recovery codes, SanDisk flash drives come with a password protected vault program that I put them in, then put that flash drive in my fire safe. Maybe not the most elegant solution, but it’s worked for me so far.
Great suggestion. Thank you very much.
Using the TOTP of the vault is fine for normal people. You’re trying to protect against apps and sites leaking your password. TOTP in the vault does that. If they can access your vault then it’s already game-over.
Yeah, makes sense. Thanks for mentioning it
I’m no expert but I think the best practice is generally to keep the backup codes in a non-electronic format in a secure location, such as on paper stored in a fireproof safe or a bank’s safe deposit box. You wouldn’t forget that location. It’s not a cheap solution, though, and a safe deposit box limits you to the bank’s operating hours only. Using your backup code is typically pretty rare, though.
I would not use the TOTP offered by your password vault, though, especially if the vault backs up to multiple devices or the cloud.
Thanks for chiming in! Non-electronic and secure are going to be interesting things to consider, especially in combination.
Bank safe isnt totally out of the question but I would like to avoid them if I can. Second location wouldnt be impossible but offline doesnt mix in well with that since my family is a mess.
If one was to make a hobby out of this I can imagine peeps putting their secrets in plain sight but make them uninteresting for the uninitiated.
You could encrypt the backup codes with a strong password using something like AES, then print the encrypted data out in hexadecimal or base64.
Honestly this would make for a neat project — build an esp32 or rp2040 based punchcard reader / printer and then print out all your backup codes (encrypted of course by some hardware based code like a set of dip switches) onto custom punchcard tape.
Neat! Now we‘re talking! :))
Jk, but this is actually pretty cool.
Use an mfa app which supports import/export of backups. To name atleast one popular open source example: Aegis.
Do backups, than you can always fairly easy and fast restore your backup after loosing a device. Usually thats enough as in most (not business relevant use cases) you do not need mfa within minutes.
If you want to go one step further you can prepare an old phone with your mfa data and store it in anywhere in your flat/house and use it as drop in replacement after loosing your actual phone. Or you could setup your mfa app on a seperate phone of your mom/friends/son/daughter, if you dont have an old phone lying around.
I like https://github.com/jamie-mh/AuthenticatorPro open source, Automatic backup and nice UX
Great idea! Thanks will check it out!
The old phone trick is neat as well. I happen to have multiple devices at home. I might just make one a backup.
Aegis is so great especially because it allows you to set an automatic backup every time you add a new TOTP. This way, a backup is made immediately after modifying the MFA vault, stored in your phone storage, where it can be grabbed by your synchronization system of choice (e.g., Syncthing), replicating the backup on your other devices, for example. This way, you can rest assured you will always have your MFA vault no matter what.
Do you need to externally encrypt the data or at least you the password field when syncing with syncthing? I mean, the traffic is encrypted already but still doesn’t feel right.
Syncthing encrypts the data, so it will be encrypted when being transferred. However, Aegis can export the vault into an encrypted file, too. So the vault file you will be transferring over an encrypted channel is encrypted itself as well. That means that the vault is secure even when at rest on some device.
Thanks for this info! Very helpful!
The not ideal solution is storing the backup codes in our password vault.
If you want to have them separated from the passwords and login information I would create a second vault with a different password just for the codes and store them side by side.
Thats what I had in mind initially. Probably not a bad solution either. I might check aegis. Need to see if its available for my phone.