3 ms·

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But

by ozim 4y ago

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for these. Problem is I don't want these TOTP tokens offsite really so it is a bit of a challange :) to come up with everything proof plan.

gzer0 4y ago
And this has now just encouraged me to buy a Pixel 6A running GrapheneOS to have as a backup at all times for my important google accounts
simcop2387 4y ago
I store them in a keepassxc database for syncing and alsomprotect it with a yubikey. Lets me back it up to other places while also allowing them to stay secure. Most other password manager solutions should also be able to be used to keep them secure and backed up.
masukomi 4y ago
i feel like I'm asking a dumb question but why not just use a password manager that syncs your stuff and handles 2FA like 1Password? Break the phone? no worries you've got the info on your desktop. House goes up in a fire, no worries, they've got it on the cloud and you can access from a friend's house / library / whatever.
- tempestn 4y ago
  You can't actually access your 1pw vault from wherever if you don't have an existing authenticated device or a copy of your secret key. That's intended to provide added security in case your master password is compromised. So to guard against the house burning down situation you need to either keep a printout of the secret key somewhere else (friend's house, bank box, etc.) or save it somewhere (secure) online where you can get it without using 1pw.
3np 4y ago
There are a lot of options, including free software and no-cloud alternatives, to get backups without doing that manually in such a cumbersome or fearful way your are now. For example: > "Password Store" ('pass' compatible) for Android also supports TOTP to tokens and Gpg encryption. > With Syncthing, 'gopass' and 'Android Password Store', I have a fully open source, very easy to reason about fully in my control, password and totp storage, accessible on all my devices. All of which can only be accessed with my Yubikey that I keep in my pocket and my GPG PIN.

by ozim 4y ago

gzer0 4y ago

And this has now just encouraged me to buy a Pixel 6A running GrapheneOS to have as a backup at all times for my important google accounts

simcop2387 4y ago

I store them in a keepassxc database for syncing and alsomprotect it with a yubikey. Lets me back it up to other places while also allowing them to stay secure. Most other password manager solutions should also be able to be used to keep them secure and backed up.

masukomi 4y ago

i feel like I'm asking a dumb question but why not just use a password manager that syncs your stuff and handles 2FA like 1Password? Break the phone? no worries you've got the info on your desktop. House goes up in a fire, no worries, they've got it on the cloud and you can access from a friend's house / library / whatever.

tempestn 4y ago
You can't actually access your 1pw vault from wherever if you don't have an existing authenticated device or a copy of your secret key. That's intended to provide added security in case your master password is compromised. So to guard against the house burning down situation you need to either keep a printout of the secret key somewhere else (friend's house, bank box, etc.) or save it somewhere (secure) online where you can get it without using 1pw.

3np 4y ago

There are a lot of options, including free software and no-cloud alternatives, to get backups without doing that manually in such a cumbersome or fearful way your are now. For example: > "Password Store" ('pass' compatible) for Android also supports TOTP to tokens and Gpg encryption. > With Syncthing, 'gopass' and 'Android Password Store', I have a fully open source, very easy to reason about fully in my control, password and totp storage, accessible on all my devices. All of which can only be accessed with my Yubikey that I keep in my pocket and my GPG PIN.