4 ms·

Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry

by eric59 13y ago

Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry more and more recovery codes around.

maratd 13y ago
Screenshot all QR codes and store them in Dropbox, which also has 2-factor authentication. Store recovery code for Dropbox in Google Docs, which also has 2-factor authentication. So for me to be totally screwed, I would have to lose my phone and have my logins expire on both Dropbox and Google. Hasn't happened yet =)
- YuriNiyazov 13y ago
  Actually, I disagree with you here (because what hasn't happened to you has actually happened to me). I was robbed at gunpoint, the perpetrator took both my phone and my laptop (the only computer authorized to login), which was the only computer that had a non-expired login. I print out all the codes, stored them in a secure place in my house (with things like my passport). For the truly paranoid, get a safe, or a safety deposit box at a bank.
  - hashtree 13y ago
    Not to mention the much more likely attack vectors with this approach over a safe/deposit box based approach (which you might be alluding to): - This has a big assumption that 2FA cannot be bypassed AND other service exploits are not possible. The recent Dropbox security paper showed this was possible: https://www.usenix.org/system/files/conference/woot13/woot13-kholia.pdf - Device stolen/lost/hacked with active logins to said services OR local copies of said 2FA recovery codes? Eek! - Our friends at the NSA love that you use Dropbox to store this versus a more secure service like SpiderOak.
  - deleted 13y ago
    [deleted]
vulf 13y ago
This may sound extra paranoid, but I've locked myself out of 2FA'd accounts before and recovery is not fun, so I go out of my way to keep the recovery codes secured but available to me in case of catastrophe. First, I make an encrypted disk image with a very strong, unique passphrase (easy on OSX, not sure about windows). In this I put the QR setup codes and my recovery codes. I put a copy of this on every device I own, every computer I own, stash it in my home directory on my server, and put it on dropbox. I then share the dropbox copy to two friends, and instruct them to hold on to it in case I lose access to all my devices. Any time I enable 2FA on a new account, like I did today, I update the image and redistribute it. I previously kept a copy on github as well as dropbox, but now that both are behind 2FA I wouldn't be able to recover from those sources if I lost all my devices. Maybe I should push a copy to pages.github.io under some secret path that only I knew. Oh, and check out BitTorrent Sync, it makes it really easy to distribute among my computers and phone without worrying about dropbox somehow losing my files or preventing my access.
packetslave 13y ago
I keep mine in a txt file on an IronKey. Something like a secure note in Lastpass would probably work too.
hashtree 13y ago
On-site robust safe and safety deposit combination.

by eric59 13y ago

Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry more and more recovery codes around.

maratd 13y ago

Screenshot all QR codes and store them in Dropbox, which also has 2-factor authentication. Store recovery code for Dropbox in Google Docs, which also has 2-factor authentication. So for me to be totally screwed, I would have to lose my phone and have my logins expire on both Dropbox and Google. Hasn't happened yet =)

YuriNiyazov 13y ago
Actually, I disagree with you here (because what hasn't happened to you has actually happened to me). I was robbed at gunpoint, the perpetrator took both my phone and my laptop (the only computer authorized to login), which was the only computer that had a non-expired login. I print out all the codes, stored them in a secure place in my house (with things like my passport). For the truly paranoid, get a safe, or a safety deposit box at a bank.
- hashtree 13y ago
  Not to mention the much more likely attack vectors with this approach over a safe/deposit box based approach (which you might be alluding to): - This has a big assumption that 2FA cannot be bypassed AND other service exploits are not possible. The recent Dropbox security paper showed this was possible: https://www.usenix.org/system/files/conference/woot13/woot13-kholia.pdf - Device stolen/lost/hacked with active logins to said services OR local copies of said 2FA recovery codes? Eek! - Our friends at the NSA love that you use Dropbox to store this versus a more secure service like SpiderOak.
- deleted 13y ago
  [deleted]

vulf 13y ago

This may sound extra paranoid, but I've locked myself out of 2FA'd accounts before and recovery is not fun, so I go out of my way to keep the recovery codes secured but available to me in case of catastrophe. First, I make an encrypted disk image with a very strong, unique passphrase (easy on OSX, not sure about windows). In this I put the QR setup codes and my recovery codes. I put a copy of this on every device I own, every computer I own, stash it in my home directory on my server, and put it on dropbox. I then share the dropbox copy to two friends, and instruct them to hold on to it in case I lose access to all my devices. Any time I enable 2FA on a new account, like I did today, I update the image and redistribute it. I previously kept a copy on github as well as dropbox, but now that both are behind 2FA I wouldn't be able to recover from those sources if I lost all my devices. Maybe I should push a copy to pages.github.io under some secret path that only I knew. Oh, and check out BitTorrent Sync, it makes it really easy to distribute among my computers and phone without worrying about dropbox somehow losing my files or preventing my access.

packetslave 13y ago

I keep mine in a txt file on an IronKey. Something like a secure note in Lastpass would probably work too.

hashtree 13y ago

On-site robust safe and safety deposit combination.