I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-time backup codes (let's call them OTBC).
I use password manager with 2FA to store all my passwords. I run password manager only on machines I own and manage. However I am mobile so I cannot use a physical vault (for example to store printed OTBC). Password manager introduced its own set of OTBC.
I am considering what is the best practice for securely managing OTBC. I assume I may lose all 2FA devices and this should not prevent me from accessing the services using the OTBC.
It is my understanding that OTBC should be treated with the same level of security precautions as passwords. Otherwise they render 2FA non-existent.
One of 2FA purposes is protection against using passwords obtained by breaching the password manager on non-authenticated devices. So OTBC to respective services cannot be stored alongside their passwords in the password manager otherwise this would render 2FA non-existent.
In result I have the necessity for two separate password managers one for passwords, one for OTBC.
Now, each of password managers introduces its own set of OTBC (to backup the 2FA for the master password) which cannot be memorized.
They should be stored outside of their respective password manager databases. So I can either store them outside of the system or in a cross-fashion:
Passwords-DB <== passwords for services + OTBC for OTBC-DB OTBC-DB <== OTBC for services + OTBC for Passwords-DB
Provided the passwords: one for Passwords-DB and one for OTBC-DB are not stored outside of my brain, is it the simplest method for managing OTBC and are there any security flaws or hidden risks in this scheme?