For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are meant to be used in cases where you do not have access to your second authentication factor, such as a lost device, traveling, etc.
What are some good ways/ideas to being able to carry around the backup codes on your person so that they are:
- Not obviously identify what service they are connected to, so that others won't see "Google Acct: 9824 24 312"
- Not easily able to be used by someone who steals a notecard with the backup codes on it for example.
- Easy for the user to understand and use without the means of anything more advanced than a basic calculator (just an example, there could be means without any device at all)