3 ms·
There are services, like Authy, that let you back them up encrypted. Whether that is appropriate, when considering the security ramifications, is up to you. I,
by Operyl 7y ago
There are services, like Authy, that let you back them up encrypted. Whether that is appropriate, when considering the security ramifications, is up to you. I, in the past, have printed out the QR codes and put them in a safe as backups.
- danShumway 7y agoJust a heads up, but the last time I checked, Authy did not have secure defaults for 2FA. Authy supports two standards -- the Google Authenticator method, and their own internal standard. Any tokens that go through their internal standard can be recovered on a new phone using just SMS verification, which defeats the entire point. Your encryption password only applies to Google Authenticator tokens. https://twitter.com/DanielShumway/status/1092095395478556674 https://twitter.com/DanielShumway/status/1092095395478556674
- PuffinBlue 7y agoYou are correct. Calling them up one time the person on the phone seemed to be able to 'see' my Cloudflare TOTP code (back when cloudflare had beef with Google about their CEO account getting hacked) but wasn't able to 'see' what my manually added Google Authenticator codes were. So I'm not even sure if Authy's own stuff is secure at all, perhaps someone from there will jump in. But using the Google Authenticator way it's a decent option. Just be sure to treat your backup key as a critical component that needs to be stored securely.
- Operyl 7y agoYou’re correct. I was referring the the standard TOTP here and not their weird Authy variant
- latchkey 7y agoOnly if you setup SMS. Don't do that. Also, turn off the multi-device feature. 2017: https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s...