4 ms·
No, just save the seed value. The one-time-use emergency codes are pointless. You can have 40 different devices all generating valid current totp codes at the
by Brian_K_White 2y ago
No, just save the seed value. The one-time-use emergency codes are pointless.
You can have 40 different devices all generating valid current totp codes at the same time, and you can spin up a new one at any time if you kjust have any way to access your passwords.
IE, if you have any form of copy of say a keepass db anywhere, it can contain the seed values for each site right along with the passwords, and you can buy a brand new phone or laptop, of any platform or os, and install any keepss compatible app, and load that db file, you will need to know the password for that db file itself out of your head, and then keepass itself can display the totp codes or you can read the seed values and enter them into some other totp app to generate the totp codes.
Always have accessible copies of your password manager db that's all. The seed values are just more stuff you keep in the db just like the passwords.
The problem is just that no one tells you that the number in the original qr code is savable and reusable. They show you the qr code or a url and don't tell you that it's the keys to your own kingdom. They let you just throw it away without ever telling you what it actually was.
If you have a working totp for some site right now, go and use it one last time to disable 2fa on that site, and the re-enable it, and this time keep the seed value. Put it right into a keepass db and sync that to at least one other place. Safe for life after that.
The one-time-use emergency codes you can ignore. Fine keep them, but they don't give you anything you don't already have with the seed value. Maybe they could be used to give to like family members or employees or something for weird never-actually-use-this scenarios, the one-time-use nature might be useful, and the ability to revoke it by just using it yourself to burn it.
- ggm 2y agoI've screenshots of every QR initialisation I've ever used saved to a specific folder and backed up on a usb stick. I also copied a giant QR which is the "copy your auth app" sequence for all of them. I printed that one out.