4 ms·
As someome who lost access to their TOTP 2FA device for ~3 months I can definitely relate to that. But SMS is still insecure and there are better ways of doing
by franga2000 7y ago
As someome who lost access to their TOTP 2FA device for ~3 months I can definitely relate to that. But SMS is still insecure and there are better ways of doing this.
For one, no one is forcing you to only have one TOTP device. You can scan that QR code as many times as you want. Have them on multiple devices.
Depending on your threat vectors, putting them into a password manager that supports it (like Bitwarden) might also be smart. Less secure than fully offline, but definitely better than SMS.
As for the backup codes - one big encrypted text file synced to the cloud of your choice should do the trick, but if you prefer the "scary men with guns" kind of security, safety deposit boxes were literally made to store this kind of stuff (bonus points for on-paper encryption).
- iudqnolq 7y agoI discovered recently the QR codes are dumber than I thought; you can even print the QR codes out or store them as screenshots depending on your threat model. Cite: https://www.eff.org/deeplinks/2017/09/guide-common-types-two-factor-authentication-web https://www.eff.org/deeplinks/2017/09/guide-common-types-two...
- __david__ 7y agoI do something silly like that. I take the qr codes and convert them into Unicode glyphs and then put them in a gpg encrypted file. I started doing this after my first phone upgrade lost all my google auth entries. Now I can just decrypt in the terminal and directly scan all the codes into google auth should I ever lose them.
- franga2000 7y agoDo you mean you use something like grencode to literally draw the QR code using Unicode box characters or do you just decode and save their contents? As an extra suggestion: if you use an Android phone for OTP, [andOTP](https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP) supports exporting directly into a PGP-encrypted JSON file which can then be either imported back into the app or converted back to QR codes with a script. Since it allows you to trigger the export using a Broadcast Intent, I have it set up to do that as a part of my weekly backup Tasker script (of course, you could also just use any other sync solution and manually export when you add a new code).
- __david__ 7y agoYeah, literal QR codes made out of unicode box characters. That way it's just scanning a bunch of codes instead of trying to recreate them just to scan them.