3 ms·

No, for exactly this reason. My recovery codes are on index cards in a physical safe, and then I've got MFA via multiple devices (TOTP on Phone + yubikey for m

• dontbenebby 8y ago
  Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same locked container as the passowords"? Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?
  • icebraining 8y ago
    Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.
    • dontbenebby 8y ago
      > Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place. Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too. (I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )