Generating and securely storing MFA/2FA recovery tokens

Question

I'm trying to implement 2FA on my site, and cannot figure out how to generate and then securely store recovery tokens.

From what I've seen, if for whatever reason you cannot MFA (lost your device maybe) you can use a recovery token as your second factor. I am concerned about storing them securely. On sites like Github you can go and view your recovery tokens at any time, which means they are not hashed and stored. This does not seem very secure. And my google-fu seems to have abandoned me when searching for guidelines and best practices on this.

PS - I'm looking for guidelines on how to implement generation and storage of recovery tokens as a service.

Answer 1

The backup keys essentially become equivalent to your password. The guidelines you are looking for are the same guidelines for storing your personal passwords. There won't be different guidelines.

The one slight difference between passwords and MFA codes is that you tend to need those codes very infrequently (maybe only ever once), and when something has gone wrong. That means that you need to follow the password management guidelines for "disaster recovery" or "business continuity" in business.

That usually means printing/writing them out and storing the physical media safely (locked, sealed, somehow obfuscated in case someone stumbles onto them) and in a way that you can access it when things have gone wrong. The details of this approach highly depend on the scope of "what can go wrong". Personally, I go with the earthquake/flood scenario where I lose my device and desktop and need to log into a new/strange device.