2FA: Why do I need to keep my backup codes for each platform on paper?

Question

I'm looking into setting up 2-factor authentication for my registered accounts. However, when setting up 2FA, for example Reddit, you need to write down backup codes in order to regain access to your account in case you lose your smartphone.

I've already read this post.

But the whole point of using password managers (yes, that's another thing) is that you don't have to write down all the passwords you've been using for all your registered accounts, and still can have different passwords for all websites in case a website gets hacked and appears to have stored all passwords in either plaintext/encrypted form (yes, yes, it still happens today). Since writing down passwords, keys, codes is really old-school.

So I'm feeling that writing down backup codes for the platforms supporting 2FA is a real step back. In fact you'd have to store these codes written on paper in a safe.

Is there any way I can be sure to regain access to my account that's been setup to use 2FA, when I lost my phone, without having to fallback to silly backup codes I've written down on paper, for each website?

Does this also mean that if you lose your phone and backup codes, you can't access your account at all?

Answer 1

Writing them to paper is one of the simplest, guaranteed to be safe from malware and hardware failure for the average people. If you have a password manager, usually you can store secure notes too, which can handle backup codes. But if you do that, then attackers who managed to breach your password manager now have everything they need to get into your account. Some 2FA apps like Authy allow syncing and backing up codes across multiple devices, but this also means you've multiplied the weak links.

You don't have to take a single approach for all of your account, perhaps you decide your social media account is not that vital and store the backup code in online account or sync the 2FA token, while still writing your email backup code in a piece of paper because it's the gateway for every account you have.

Answer 2

But the whole point of using password managers (yes, that's another thing) is that you don't have to write down all the passwords...

Backup codes are distinct from passwords.

Passwords are something you need every time you use the account. The danger of writing down passwords is they will naturally be near or even on your computer. Anyone with physical access to your computer now has your passwords.

Backup codes are for emergencies and, ideally, are never used. They can be stored securely and well away from your computer.

And, perhaps most importantly, targeted, physical attacks are a very low risk for most people. If you're a business, or don't trust the people who have physical access to your stuff, a basic safe might be warranted and useful for lots of things. But for most people Joe Burglar is not going to be searching for your backup codes, they'll just take your whole computer.

---

Why do I need to keep my backup codes for each platform on paper?

You don't. You just need them somewhere offline.

You could put them on an encrypted USB thumb drive. Omit your usernames if you feel you can remember them. Store the key in your password manager. Now an attacker must have three pieces: the drive, the key, and your usernames. Put the drive in a safe location (not necessarily a safe) away from your computer. It can be in the same room, just not an obvious location. A "bug out" bag is a good choice, in the event of a disaster you will be able to restore access.

You can also put the backup codes into your password manager along with your One-Time Passwords. This does put all your eggs into one basket, but that's the trade off for using a password manager.

Finally, you can use a dedicated device such as YubiKey.

---

Is there any way I can be sure to regain access to my account that's been setup to use 2FA, when I lost my phone, without having to fallback to silly backup codes...?

Depends on the site. Some will allow you to recover by sending you an email.

---

Security is about managing trade offs and risks. Preventing attacks opens opportunities for new attacks. So long as those new attacks are more difficult you're headed in the right direction.

Weak, reused, and written passwords are solved by long, unique, random passwords in a password manager; a password manager brings its own much smaller risks. Multi-Factor Authentication further secures your accounts, even if your password is compromised the MFA protects you and informs you someone has your password, but now the risk is losing your MFA device. This is solved with backup codes. The backup codes could be stolen, but now the attack must be physical, they must come to your location, which immensely reduces the risk.

Answer 3

As @Martheen says:

If you have a password manager, usually you can store secure notes too, which can handle backup codes. But if you do that, then attackers who managed to breach your password manager now have everything they need to get into your account.

Usually, you need to type your Master password several times per day(/hour). This implies:

1. The password must be reasonably simple to remember and type.
2. A keylogger or similar has many opportunities to get access to your password database.

Taking all this into account, one (relatively) safe approach that avoids writing 2FA codes on paper is to have a separate password database for 2FA codes. This database ...

1. ... can have an arbitrarily complex password. You only need to unlock it in case your 2FA device fails / gets lost. This password is the only secret you need to write down on paper and keep in a safe.
2. ... is only rarely used and therefore less prone to keyloggers.

In my case, the "2FA database" is actually not a password manager but a VeraCrypt container, but this makes little difference. Just make sure to have backups of this encrypted database.

Answer 4

Using a password manager to generate the 2FA codes is certainly better from a resiliency standpoint than just having a single 2FA generator on a phone that can be easily lost or damaged. What the password manager actually stores and syncs is the initialization seed stored in the QR code, allowing any device you install the password manager app on to generate codes. This reduces the need to have separate backup codes stored.

Ultimately, the most secure thing is not to store the backup codes anywhere, as they are just an additional pathway for someone to access the account--the reason they exist is not for improved security but because the risk of losing the 2FA generator device is too great for some (most?) people. Since most hacking incidents involve a remote attacker not a physical break in, even storing them on a paper on your desk would still be a huge improvement over no 2FA at all. Of course for some people (ex. famous people, businesses, etc) a break in might be a very realistic threat for account takeover and they really do need to store them in a safe.

Does this also mean that if you lose your phone and backup codes, you can't access your account at all?

That all depends on the platform. Some of them still have a way to reset the account, although typically not just a reset link. Might be a more hands on process like calling your sales rep for B2B software, talking to IT if its something you use for work, sending in your photo ID, etc. Many, however, do take enabling 2FA as a sign that absolutely no logins should be allowed without a valid 2FA code and they will not reset it for you under any circumstances.

Answer 5

One can scan the QR code with the two devices at once (in order to have a backup generator available as primary recovery option) - and then generally does not need recovery codes; I'd still keep them as a secondary recovery option. When already having enable 2FA for a single device, it's usually required to disable it, in order to scan twice when re-enabling it.

Answer 6

As stated in the previous answers, backup codes are meant to use in the future to authenticate and regain your access (if required). It has to be stored somewhere safely and should be accessible easily at anytime when required.

1. Storing in a paper is a simple way but securing and keeping it all the time with you is a challenging task.

2. Storing in password valut or secure note is like loosing mobile with backup codes and all other passwords and provide more access to the attacker.

3. Storing in encrypted USB drives or encrypted databases is more like storing in a paper but easily accessible and attacker can steal and virus can destroy.

My suggestion is to simply store it in your email (draft/self note) in a simple encrypted format by shifting any digits (like caesar cipher) which is easily accessible all the time and no one can easily find and directly use it. (Hopefully you won't store email backup code with this :)