Should a 2FA recovery key be stored along with a password?

Question

Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator.

What are the recommended practices when it comes to storing these codes?

Should these recovery codes be stored along with the password in a password manager? Should they be physically written down and stored somewhere safe?

My main concern is the password manager being a single point of failure. If my password manager is compromised, 2FA is essentially worthless on all the accounts that have it enabled.

Answer 1

For your application, I would suggest, storing the recovery keys on plain paper that you put inside a home safe. Thats enough security. They rather steal the phone or 2FA token from you if they really want your account. And physical attacks are very rare. Actually, you dont even need to put them in a safe. You can put them in the desk drawer at home.

But do not store them inside the password manager, since theres a too high risk a trojan will compromise the codes. Once you have unlocked the password manager with the master password, any trojan can compromise any password in your password manager.

Answer 2

You can store them in a Keepass database (with a good password). You can print them on paper, and keep that somewhere safe.

You can create an Android VM in Virtualbox, install Authenticator and use that as backup for 2FA. In Amazon AWS you can use several of these accounts, but I don't know if Google allows this. That VM should be kept on an encrypted volume like Truecrypt or DMG, preferably on another machine. You can make a backup on an external disk and use portable Virtualbox to run it (on a Windows host).