2

I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options:

  • In a secure note on LastPass
  • In a Dropbox folder
  • On a usb stick

All of them seem to have their respective pitfalls though:

In the case of lastpass: My passwords are all random strings about 20 - 30 characters long (based on the services password policies). So I doubt anyone’s going to be able to guess or brute force a password to one of my accounts. Therefore the most likely way I’ll have a compromised account is if someone compromises lastpass - in which case 2FA would be pointless if the security codes were also stored there.

In the case of Dropbox: The most likely reason I’ll need the security codes is if I lose my phone - but then I wont be able to access Dropbox anyways because I have 2FA enabled there too so those recovery codes will all essentially be lost.

In the case of a USB stick: This seems like the equilavent of writing passwords on post it notes - easy to lose/forget or may just not work 10 years down the line when its needed.

Out of the 3 the usb stick seems like the best option but I was wondering if anyone has come up with a better way of storing recovery codes? Also if physical storage is the way to go is there a preferable medium for this? Perhaps some sort of storage that is durable over a long period of time and likely to stay relevant into the future?

  • Many 2FA backup code implementations would email you when a backup recovery code is used. So storing the 2FA codes in your password manager may not necessarily be entirely pointless. – Lie Ryan Oct 1 '17 at 15:40
  • Really? Does google 2FA does that? – Sharen Eayrs Sep 30 '18 at 22:16
3

First of all, let's clarify that 2FA recovery codes are used to bypass 2FA itself.

2FA's main purpose is to make sure that you provide a secret from two different "channels", for example, something you know or something you have. The password is something you know and the recovery codes, if kept in memory (your brain or your computer's hard disk) is also something you know. Without going into too much discussion about the security of these recovery codes, it seems obvious to me that the "something you have" factor works better when completely outside the virtual world. That is, keeping the codes in a piece of paper, or small pieces of paper for each code, may be the best option IMHO. Clearly encrypting it and storing it in the cloud or in a separate computer/device/usb may work, but eventually you need to decrypt and access these codes in plain text. In an emergency it may not be ideal or if your systems/network have been compromised, the unencrypted codes might be accessible to an attacker. Therefore, I believe that if you print the code and keep in your wallet for example you maintain the secure properties of 2FA. One may need to reconsider it if travelling by plane as the officials might be able to force you to provide your password and confiscate your wallet. So just a note to be aware of :)

2

Option 4: Print them in hardcopy (not digital) and keep them in a place you can keep them secure.

  • Still have to make sure the printer isn't logging what it printed though, or if it is figure out how to clear it. Unless by "print" you mean "write down" in which case I heartily agree, so long as you won't need them on short notice. – AndrolGenhald Oct 3 '17 at 13:46
  • You “clear a printer” by sending it a file containing 20 pages of whitespaces. I hear postscript is making a comeback. – user2497 Oct 3 '17 at 17:12
0

I keep mine in an encrypted document stored on iCloud. The iCloud account has two-factor authentication enabled, but I have four devices registered to it, and I think the chances of me losing my laptop, desktop, phone and tablet simultaneously are pretty low. Naturally, I have the encryption password and the iCloud password committed to memory.

0

I keep my passwords in a local storage password manager, with a backup on a different device, because as a rather old dinosaurus, I do not really trust the cloud for strong privacy. The same in my real life, I carry my home keys in my pocket, and do not leave them in a flower pot to just find them when I need them.

With that process, I keep the recovery codes in the password manager vault along with the credentials.

Risk analysis:

  • password vault compromission: the attacker must both steal my phone (or computer) and guess the master password - global security at a 2FA level
  • password vault is lost or destroyed: I have a backup (in fact 2) so I should be able to restore it - but I should change all my passwords including the master one and all recovery codes if that happened...
  • the (numeric) note is lost or no longer readable: I use the password manager on a regular basis on at least 2 different devices, so I should notice if one was down

IMHO, it can make sense to keep the recovery codes even in the same place as the credentials, because I had to use them after a problem when changing a password: the server registered a password that I mistyped, so nobody (not even I) knew it.

For your use case, the password vault is in the cloud. I would not store the recovery codes in the vault because the access is already 2FA protected through you phone. I would either configure a backup access from a second device, or revert to the good old paper in a physical safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.