4

I'm trying to implement 2FA on my site, and cannot figure out how to generate and then securely store recovery tokens.

From what I've seen, if for whatever reason you cannot MFA (lost your device maybe) you can use a recovery token as your second factor. I am concerned about storing them securely. On sites like Github you can go and view your recovery tokens at any time, which means they are not hashed and stored. This does not seem very secure. And my google-fu seems to have abandoned me when searching for guidelines and best practices on this.

PS - I'm looking for guidelines on how to implement generation and storage of recovery tokens as a service.

Improve this question
2
  • Every site I've seen stores the MFA codes in clear text. And they tend to be single-use. – schroeder♦ Aug 29 '19 at 11:20
  • @schroeder I figured. Thanks for your help. – elssar Aug 30 '19 at 3:57
2

The backup keys essentially become equivalent to your password. The guidelines you are looking for are the same guidelines for storing your personal passwords. There won't be different guidelines.

The one slight difference between passwords and MFA codes is that you tend to need those codes very infrequently (maybe only ever once), and when something has gone wrong. That means that you need to follow the password management guidelines for "disaster recovery" or "business continuity" in business.

That usually means printing/writing them out and storing the physical media safely (locked, sealed, somehow obfuscated in case someone stumbles onto them) and in a way that you can access it when things have gone wrong. The details of this approach highly depend on the scope of "what can go wrong". Personally, I go with the earthquake/flood scenario where I lose my device and desktop and need to log into a new/strange device.

Improve this answer
5
  • Ah, looks like my question is unclear. What I'm looking for are guidelines for storing recovery tokens as a service, as in implementation guidelines. – elssar Aug 29 '19 at 10:50
  • 1
    PCI DSS requires MFA to be implemented as defined in Requirement 8 and its sub-requirements. Did you have a look at it? It may give hints pcihispano.com/contenido/uploads/2016/09/PCI_DSS_v3-2-1.pdf – Soufiane Tahiri Aug 29 '19 at 11:09
  • Or do you mean, you want to generate and store your service's MFA codes securely? – schroeder♦ Aug 29 '19 at 11:19
  • @SoufianeTahiri thanks, that is very helpful – elssar Aug 30 '19 at 3:56
  • You could just store the hashes of the MFA codes like you would do with the users password. Honouring regular safety precautions like using salt and key derivation function like argon2 or pbkdf2. – Reiner Rottmann Jan 15 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.