My current security model (at least for passwords) is to store them encrypted at rest and use GPG (in combination with an Yubikey) to perform encryption / decryption. I'm using
pass (https://www.passwordstore.org/) to help automate the process for encryption / decryption. These files are stored 0700 and I plan to synchronize them to either iCloud Drive or a proper git repository (at some point). Right now I'm just backing them up to an Ironkey (D20402A). I am using 4096 bit subkeys for GPG encryption / decryption.
TOTP codes however, I still store on my iPhone (using Google Authenticator). I know there are third party solutions like Authy but I'd like to migrate away from my phone if at all possible.
Ideally I'd like to store my TOTP secret keys in a way that can be retrieved (and adequately backed up) from my computer for easier scripting and automation. There are some services like AWS that require an TOTP code alongside my normal authentication credentials which are motivating this.
Would storing these TOTP secrets alongside my passwords (provided both are encrypted) safe enough or just a bad idea? The way I see it there are basically four items necessary for somebody to unlock my keys:
- Physical computer (full-disk encryption using APFS) or Ironkey
- Physical Yubikey (or the backup, or the master key backup)
- Disk or Ironkey decryption password
- My Yubikey PIN
There's a tool called https://github.com/tadfisher/pass-otp that I may use for this.
I'm torn on whether this is an acceptable security solution. On one hand, the "second factor" aspect that TOTP brings is subverted by storing all the secrets on a single device.
On the other hand, I am reasonably confident that the device and methods I plan on using around my proposed solution is adequate enough to protect this data. I recognize all of this flies out the window if my machine itself is compromised (but that leaves me screwed in any situation).