I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options:
- In a secure note on LastPass
- In a Dropbox folder
- On a usb stick
All of them seem to have their respective pitfalls though:
In the case of lastpass: My passwords are all random strings about 20 - 30 characters long (based on the services password policies). So I doubt anyone’s going to be able to guess or brute force a password to one of my accounts. Therefore the most likely way I’ll have a compromised account is if someone compromises lastpass - in which case 2FA would be pointless if the security codes were also stored there.
In the case of Dropbox: The most likely reason I’ll need the security codes is if I lose my phone - but then I wont be able to access Dropbox anyways because I have 2FA enabled there too so those recovery codes will all essentially be lost.
In the case of a USB stick: This seems like the equilavent of writing passwords on post it notes - easy to lose/forget or may just not work 10 years down the line when its needed.
Out of the 3 the usb stick seems like the best option but I was wondering if anyone has come up with a better way of storing recovery codes? Also if physical storage is the way to go is there a preferable medium for this? Perhaps some sort of storage that is durable over a long period of time and likely to stay relevant into the future?