I doubt a 'standard' how to do it can be independently developed and implemented. I use a non web-based password manager, a backup strategy that makes sense, an

I doubt a 'standard' how to do it can be independently developed and implemented. I use a non web-based password manager, a backup strategy that makes sense, and have a secure setup with regard to my threat level. And with regards to your fear from Google: Short from full-on identify theft I have a controversial solution: E-Mail is something one should pay for. E-Mail is essential ; the one thing you can use to pretty much sign up for everything, the one thing to use to reset passwords ; the one form of communication which is open, readily accessible to almost everyone, crosses borders, doesn't ask for fees, doesn't need a specific app, et cetera I once lost my complete password database (if you sense irony here, it was a long time ago, and I was being stupid), including my E-Mail password, no 2FA set up, nothing. I was completely locked out, but: since I paid for the service: I could open a ticket, I could get a human(!) within a short time frame who actively assisted and I could proof my identify via easy means. I was greeted with empathy, we could work with whatever I knew about the account and related information. There was no ridiculous meaningless questionnaire, no support ticket answered by some volunteer moderators. I was dealing with someone from staff who knew what they were doing, and we worked it out quickly. Not saying it would have been impossible to restore access to a Gmail Account, but at the very least it would have been incredibly more painful, I am sure of that much.