I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app.
I want to set up a recovery option, and I have two choices:
- Phone number: I've read about attackers abusing phone companies' customer services to compromise the phone number of victims. It's hard for me to trust my phone company with all of my online accounts, given that they have the reputation not to take security seriously,
- Another email address: this seems to be the safest option, but it's pretty obvious that I should not set up 2FA on this account, which would reduce the security of my main account to a simple password, which was exactly what 2FA should avoid!
My idea is to create an email address that has no link to my main Google account, with a very strong password (like in 256-bits crypto-secure-RNG strong password), and to store its password securely. Is it really more secure than an account without 2FA?