3 ms·
Is the only viable solution to have 2FA setup on multiple devices, with at least device in a "break glass in emergency" type of vault storage?
by babyshake 4y ago
Is the only viable solution to have 2FA setup on multiple devices, with at least device in a "break glass in emergency" type of vault storage?
- bxparks 4y agoYup. I keep a cheap backup Android phone with Google Authenticator installed just for this purpose. Every time I add a 2FA code, I add it to the backup phone. I also print out the QR code, but a backup phone is far more convenient. I dropped my main phone into the toilet a week ago, completely fried it. Moved the SIM card to my backup phone, and carried on like almost nothing happened. I then powered up my 10-year old Nexus 7 tablet, and duplicated all my 2FA codes to the tablet. When I get a new replacement phone, I will duplicate my 2FA codes again.
- Nextgrid 4y agoThis is extremely inconvenient as it means if you're signing up for an account you need to have access to all those devices, even the one that's supposed to be in vault storage (potentially a bank vault, etc). TOTP just isn't a good protocol for this. Last-resort 2FA should be based on public key crypto where your last-resort device has a public/private key and you can enroll it as a recovery token by providing the (static) public key - this means you do not need active access to the device to enroll it.