3

I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult.

YubiKey

The YubiKey is used in two different modes - OTP and FIDO2. For OTP, a secret key was generated and has been backed up using a paper backup in multiple, physically distinct locations. It is very unlikely that all these locations will be compromised at the same time.

However, for FIDO2, the issue is that one key can't simply be "cloned" to another by design. Furthermore, I don't recall all sites on which I used my YubiKey as a second factor and ykman fido credentials list --pin ... returns an empty list.

Furthermore, authenticating with every single service and adding a new YubiKey really doesn't scale well with 20, 50, 100, 200 different services.

Is there a better strategy to prevent loss of access than to manually add a second (or third) YubiKey and just hope I didn't forget anything?

Google Authenticator

I've also recently tried to back up my Google Authenticator codes. While these can be exported and transferred to another device through QR codes, this really only works well when switching phones, i.e. when the initial phone is still around. The problem is that the "secrets" themselves can't be extracted easily, and that the app does not allow screenshots.

As a result, I can't "store" my authenticator secrets in a safe location (e.g. on an encrypted file) in case my phone breaks, gets stolen, gets teleported away during a resonance cascade, etc.

The best way I could find to "back up" my Google Authenticator keys is to photograph the screen of my phone with a second device, then store that photograph somewhere and "scan" the code again from a new device to import them again.

Is there a better strategy to prevent loss of access than to photograph a QR code?

In Summary

How can I effectively make backups of my MFA keys (TOTP, FIDO2) in a way that scales to tens, if not hundreds of services?

2 Answers 2

0

Typically, there are a couple ways one can recover from losing access to one's second factor, depending on the second factor.

First, many sites provide recovery codes. Those can be printed out or backed up in a secure location, such as in a safety deposit box or an encrypted archive held by a trusted friend.

Second, there are security keys you can clone. DiceKeys is a way to securely generate secrets, and it can be used to seed a SoloKey security key with appropriate firmware. Whether this is a good idea is up to you, but it is an option.

For TOTP secrets, one can use Authy, which supports all the same functionality as Google Authenticator and also supports encrypted backups. If you use a secure passphrase and store it separately (such as in a password manager or with your recovery codes), this can be a good way to store your TOTP secrets.

Personally, where possible, I try to use a regular YubiKey plus TOTP with Authy. I always use the YubiKey on sites that support it, to provide better resistance against phishing, and on those sites, I have the TOTP as a backup. I also store my recovery codes in a secure location.

2
  • How can I migrate my Google Authenticator accounts to Authy? Also, what do I do with my existing FIDO2 keys in my YubiKey?
    – Joseph
    Mar 10, 2023 at 22:38
  • You have to go into each website, disable 2FA with Google Authenticator, and then re-enable it with Authy. There's unfortunately no easy solution here. For the YubiKey, you can just leave it as an additional option and add a new security key as you get to it. Unless you lose your YubiKey (which is unlikely if you just leave it at home), there's not much risk to leaving it on your account.
    – bk2204
    Mar 10, 2023 at 23:46
0

I suggest replacing the unfriendly Google 2FA app with the free and open source (FOSS) Aegis 2FA app.

You will need to disable Google 2FA in each account and then reenable 2FA using Aegis.

Aegis features include:

  1. adding a login password to protect the 2FA vault.
  2. viewing an entry to see the seed code, to copy it and store it somewhere else for backup, along with recovery codes, such as free encrypted StandardNotes or a 2FA vault in KeePassXC, separate from my password vault.
  3. viewing the QR code stored for an entry to scan onto another phone.
  4. exporting the 2FA vault in several encrypted and unencrypted file formats.
  5. enabling auto backups to the micro SD memory card in my phone.

[I backup my password vault to a Samsung FIT+ flash drive stored in a fireproof waterproof digital media safe, and encrypted Proton Drive in Switzerland.]

I always install Aegis on two phones for redundancy. An old retired phone with no active phone service works fine for this purpose. The 2FA codes displayed by each phone for the same entry should match, to confirm proper setup.

It is best to have two YubiKeys, for backup. Or, set a single YubiKey as one of several enabled 2FA methods until a second YubiKey is purchased.

YubiKey is still not that widely supported by many websites. So, it should be a short list of YubiKey accounts.

For organization, I keep a spreadsheet list of my accounts with the type of authentication used (random password, 2FA off, 2FA on with TOTP, email code, voice code, prompt).

I do not use SMS text for any 2FA and have removed my phone number from all accounts where not required. I use several unpublished Proton Mail email aliases for website login. I do not use Big Tech snoop mail except for unimportant messages and junk mail.

2
  • 1
    If you're setting up a backup phone, no need to rotate the TOTP (Authenticator) key on all your accounts. Just use the QR-code-based transfer functionality (which exposes the original secret key) to add the account to the second phone, potentially to an app where backups are easier. Do bear in mind though: backups are also potential points of compromise, and these are credentials you're handling. If an attacker sees them, the attacker can potentially break into your accounts. Don't put them anywhere you can't keep confidential.
    – CBHacking
    Mar 11, 2023 at 12:18
  • I use the 3-2-1 robust backup strategy for important files and password/2FA vaults. At least 3 copies of the files, stored on two types of storage media, with at least one copy off site for disaster backup. The files are encrypted and physically secure. The bigger risk is not having a backup file of passwords and 2FA codes. Aegis also allows adding a vault password, Google 2FA app does not. My phone also has a login password.
    – user290212
    Mar 11, 2023 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .