8

First of all, the secret key in discuss is defined as when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually enter into your TOTP-generating device/app.

Some services provide one-time use backup codes for two-factor authentication, for the sake if you lose your code generating device, but some don't provide backup codes. For those services who don't provide backup codes, I tend to store their secret key.

My question is, is it safe to store those secret keys the same way one store backup codes? Is there any differences?

I believe the secret key displayed on screen for user to manually enter are already included in the QR code, and it can be used to entered into any 2FA apps, to make different apps on different devices to generate the same TOTP codes. Please correct me if I am wrong about this.

Improve this question
2
  • 1
    My guess is that the backup code is some sort of password the system gives you to allow you to see the secret key again. By this logic, it is functionally equivalent to the secret key although not identical.
    – SEJPM
    Commented Mar 5, 2016 at 12:41
  • @SEJPM, to my understanding/experience, backup codes only let you login for one time, they won't necessarily reveal the secret key to you. But once you logged in, you can regenerate a new secret key if you want. And yeah, they serve the same purpose in terms of logging you in, except backup codes are one-time use. So I assume storing backup codes should somewhat safer then storing secret keys, since you can pass the security check in unlimited times once you have the secret key.
    – AlienBoy
    Commented Apr 8, 2016 at 6:38

1 Answer 1

Reset to default
6

Yes, anyone who has the secret key can use it to generate one-time passwords for your account. It should be treated in the same way as a password for a site that doesn't have 2FA. It's more secure mostly because the user doesn't get to choose it, and so can't use a weak password or a password they've used on another site.

In particular, I would advise against storing 2FA secret keys in the same place as you store passwords. If you do, then anyone who compromises that store has got both factors. If you use a password manager for your passwords, use a different program for your 2FA codes.

Improve this answer
2
  • 2
    Thanks for your answer! I do separately store my password and 2FA/2SV codes. Seems you haven't directly answered my main question, but judging from what you said, storing backup codes is slightly safer than storing secret keys, if one can choose, since backup codes are one-time use. Am I correct?
    – AlienBoy
    Commented Jan 15, 2016 at 10:48
  • 2
    @AlienBoy Yes, it's much safer to store backup codes than secret keys.
    – Mike Scott
    Commented Jan 15, 2016 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .