Is there any Security Benefits (auditing) to keeping old emails/text that give 2FA account codes?

Question

Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text?

I always wonder if seeing one that is unread could queue me in to something bad happening but also concerned that keeping such a long history might reveal some secrets with the length of history if they are all kept.

Has anybody written any material on this matter in the Security Sphere?

I feel this is different from HOTP with as HMAC hashing algoritme a hash from the SHA-2 family because I'm asking about security posed by long-term storage of old access codes.

Answer 1

Usually there is no main security risk or benefit when it comes to keeping old emails and text containing time-bound 2FA codes.

There are potential enumeration opportunities where an attacker could know when you logged in and first set up MFA by analysing the codes received by datetime, however this is a stretch and if they already have access to your phone/mail, they will be able to do far worse with less effort.

Roger Grimes wrote a book with Wiley specifically around Hacking Multifactor Authentication, however these attacks are more related to security issues around SMS based MFA, and MFA fatigue attacks.

Answer 2

The difference in doing so versus not doing so is miniscule in practice.

The only real information either you or an attacker can get is when you logged onto which online service. That may or may not be useful in some circumstances.

So for example, an attacker could tell you logged into e-Bay on the 15th of April 2021 at 20:43. This in turn would indicate you had an e-Bay account associated with that address at that time.