4 ms·
Other people have given a lot of options, but I'll throw my solution in the ring. I have a _separate_ KeePassXC database where I store the original OTP secret
by nucleardog 4y ago
Other people have given a lot of options, but I'll throw my solution in the ring.
I have a _separate_ KeePassXC database where I store the original OTP secret (if you click "add manually" or "can't scan", etc when the QR code pops up... it will give you the secret that's in the QR code) and recovery codes.
If I ever lose my phone/yubikey/etc, I can go unlock my "break glass in case of emergency" database and access accounts directly or recover from there.
I keep this in a separate database versus, say, just putting the password + OTP secret + recovery codes all in the same Bitwarden vault because I want to maintain the full security of the second factor. If my e-mail and password for Bitwarden is enough to get you the username/password/otp then I figure it's really only protecting against credential stuffing.