4 ms·

Related: anyone have a good 2FA backup solution? Like if I loose my phone at this point I’d be pretty stuffed as my Google Auth app would be gone and my text 2F

Related: anyone have a good 2FA backup solution? Like if I loose my phone at this point I’d be pretty stuffed as my Google Auth app would be gone and my text 2FA also gone in the same moment.

habibur 5y ago
This. I am pretty scared of losing my phone too. Reinstalling the app didn't seem to revive the tokens, last time I tried.
- simonbarker87 5y ago
  Yeh, 2FA through an authenticator app feels so fragile for the consequences of something going wrong.
- refurb 5y ago
  And as far as I know you can only have one device enabled with Google Authenticator at a time? If it could be on multiple devices then I could set up an old phone and have it as a backup. Edit: I’m wrong. You can sync two Authenticator apps using the same QR code during setup.
BLKNSLVR 5y ago
You can export Google Auth tokens and reimport them on a separate device. Authy seems to sync between the 2 devices I have with it installed (which indicates that it's stored "in the cloud"). I always have second device mirroring the important stuff on my primary device. Usually my most recently replaced phone.
- simonbarker87 5y ago
  As I was typing the question I thought “I guess my old phone could do the job?” I’m wondering there is a middle ground option.
  - ZGDUwpqEWpUZ 5y ago
    There is the OTP extension[1] for Password Store[2], although it kind of defeats the point of 2FA to have OTP tokens stored alongside passwords. Might be best used as a backup? [1] https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp [2] https://www.passwordstore.org https://www.passwordstore.org
- toastal 5y ago
  I wouldn't trust closed source services for something this simple. Authy wants your phone number and Google wants anything it can get its hands on. There are plenty of open source options with backup options.
dorianmariefr 5y ago
You usually have backup codes, you can print them, send them to yourself in your emails, have them in a passport manager, as notes, etc.
- simonbarker87 5y ago
  Sure, that’s a massive pain in the butt though. I’m thinking about something that allows me to get back up and running with the same system relatively quickly.
petepete 5y ago
I use BitWarden for 2FA via their paid plan (£10 per year). My BitWarden account is secured by Yubikey, of which I have two.
- simonbarker87 5y ago
  Ok, think I need to look at Yubikey as it keeps coming up here. I have a paid LastPass account, maybe there is something in there I can use.
  - petepete 5y ago
    Yeah, you can lock your LastPass with it in the same way I do mine. Knowing my passwords and 2FA are protected and backed up is a huge relief.
willis936 5y ago
TOTP is based off of a shared secret, so keeping that secret backed up is possible. I keep all of my TOTP tokens in a keepass database that is synced to my computers. If my keepass database is ever stolen and the encryption defeated then I'd be hosed, but I have a feeling there would be much worse problems in the world on that day.
- AndrewOMartin 5y ago
  Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it. I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario. Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)
  - willis936 5y ago
    Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible. My master password has hundreds of bits of entropy and only leaves my brain to enter it. Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.
  - rasse 5y ago
    Sounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.
u2077 5y ago
I use strongbox[1] on iOS and it has a feature to print off your entire database (automatically formats everything). The passwords are stored in a standard kdbx file that you can sync manually or use drive, iCloud, etc. KeepassXC[2] has browser extensions and cross-platform apps and pairs well with strongbox. (No print feature afaik) Both apps are open-source. [1] https://strongboxsafe.com/ https://strongboxsafe.com/ [2] https://keepassxc.org// https://keepassxc.org//
giaour 5y ago
When you set up Google Auth for a site, you can capture the seed value and back that up. 1Password has TOTP (Google Auth protocol) support baked in if you're looking for a way to use TOTP without relying on a single physical device.
woleium 5y ago
LastPass authenticator uses centralized (encrypted) storage of keys
1MachineElf 5y ago
Use Bitwarden. You can back up everything into an encrypted JSON file - including your 2FA TOTP stuff. Import it into a self-hosted Bitwarden too, if you like. EDIT: Exactly as petepete said. Multiple FIDO tokens like Yubikeys are supported.
gregjor 5y ago
iCloud Keychain works across devices, backed up automatically to iCloud. Only for Apple devices but works great.

Related: anyone have a good 2FA backup solution? Like if I loose my phone at this point I’d be pretty stuffed as my Google Auth app would be gone and my text 2FA also gone in the same moment.

habibur 5y ago

This. I am pretty scared of losing my phone too. Reinstalling the app didn't seem to revive the tokens, last time I tried.

simonbarker87 5y ago
Yeh, 2FA through an authenticator app feels so fragile for the consequences of something going wrong.
refurb 5y ago
And as far as I know you can only have one device enabled with Google Authenticator at a time? If it could be on multiple devices then I could set up an old phone and have it as a backup. Edit: I’m wrong. You can sync two Authenticator apps using the same QR code during setup.

BLKNSLVR 5y ago

You can export Google Auth tokens and reimport them on a separate device. Authy seems to sync between the 2 devices I have with it installed (which indicates that it's stored "in the cloud"). I always have second device mirroring the important stuff on my primary device. Usually my most recently replaced phone.

simonbarker87 5y ago
As I was typing the question I thought “I guess my old phone could do the job?” I’m wondering there is a middle ground option.
- ZGDUwpqEWpUZ 5y ago
  There is the OTP extension[1] for Password Store[2], although it kind of defeats the point of 2FA to have OTP tokens stored alongside passwords. Might be best used as a backup? [1] https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp [2] https://www.passwordstore.org https://www.passwordstore.org
toastal 5y ago
I wouldn't trust closed source services for something this simple. Authy wants your phone number and Google wants anything it can get its hands on. There are plenty of open source options with backup options.

dorianmariefr 5y ago

You usually have backup codes, you can print them, send them to yourself in your emails, have them in a passport manager, as notes, etc.

simonbarker87 5y ago
Sure, that’s a massive pain in the butt though. I’m thinking about something that allows me to get back up and running with the same system relatively quickly.

petepete 5y ago

I use BitWarden for 2FA via their paid plan (£10 per year). My BitWarden account is secured by Yubikey, of which I have two.

simonbarker87 5y ago
Ok, think I need to look at Yubikey as it keeps coming up here. I have a paid LastPass account, maybe there is something in there I can use.
- petepete 5y ago
  Yeah, you can lock your LastPass with it in the same way I do mine. Knowing my passwords and 2FA are protected and backed up is a huge relief.

willis936 5y ago

TOTP is based off of a shared secret, so keeping that secret backed up is possible. I keep all of my TOTP tokens in a keepass database that is synced to my computers. If my keepass database is ever stolen and the encryption defeated then I'd be hosed, but I have a feeling there would be much worse problems in the world on that day.

AndrewOMartin 5y ago
Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it. I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario. Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)
- willis936 5y ago
  Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible. My master password has hundreds of bits of entropy and only leaves my brain to enter it. Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.
- rasse 5y ago
  Sounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.

u2077 5y ago

I use strongbox[1] on iOS and it has a feature to print off your entire database (automatically formats everything). The passwords are stored in a standard kdbx file that you can sync manually or use drive, iCloud, etc. KeepassXC[2] has browser extensions and cross-platform apps and pairs well with strongbox. (No print feature afaik) Both apps are open-source. [1] https://strongboxsafe.com/ https://strongboxsafe.com/ [2] https://keepassxc.org// https://keepassxc.org//

giaour 5y ago

When you set up Google Auth for a site, you can capture the seed value and back that up. 1Password has TOTP (Google Auth protocol) support baked in if you're looking for a way to use TOTP without relying on a single physical device.

woleium 5y ago

LastPass authenticator uses centralized (encrypted) storage of keys

1MachineElf 5y ago

Use Bitwarden. You can back up everything into an encrypted JSON file - including your 2FA TOTP stuff. Import it into a self-hosted Bitwarden too, if you like. EDIT: Exactly as petepete said. Multiple FIDO tokens like Yubikeys are supported.

gregjor 5y ago

iCloud Keychain works across devices, backed up automatically to iCloud. Only for Apple devices but works great.