Best practices for usefully storing two factor authentication backup codes?

Question

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are meant to be used in cases where you do not have access to your second authentication factor, such as a lost device, traveling, etc.

What are some good ways/ideas to being able to carry around the backup codes on your person so that they are:

1. Not obviously identify what service they are connected to, so that others won't see "Google Acct: 9824 24 312"
2. Not easily able to be used by someone who steals a notecard with the backup codes on it for example.
3. Easy for the user to understand and use without the means of anything more advanced than a basic calculator (just an example, there could be means without any device at all)

Answer 1

Use the One-Time Pad method to encrypt the codes. Then you can easily decrypt them with a pen and paper as long as you remember the key. Since the 2fa code's characters are nearly-uniform (all characters are equally likely to appear in each key position), you can use a non-uniform key such as an easy-to-remember phrase.

A bonus to encrypting your codes is you can carry multiple copies of them (one in your suitcase, one in your wallet, one on a public URL) and not worry about them getting lost or stolen.

One weakness of this is if you use the same key to use a One-Time Pad to encrypt all your 2fa backup codes and one of your codes gets brute-forced, the attacker can derive the key and then decrypt all your codes. While it is standard practice for account providers to rate-limit logins to help prevent brute-force attacks, some account providers may have worse protection than others and it should not be assumed that all account providers have adequate protection. Your 2fa backup code security is then only as good as the weakest account provider. Therefore, you should use a different key for each account which negates one of the major benefits of this method: that you only have to memorize one key.

On the uniformity of 2FA codes

When using One-Time Pads (OTP) to encrypt a sentence, the key must be uniform to guard against frequency analysis. But in general, either the plaintext or the key need to be uniform. Google Authenticator and other 2fa providers use a hash generated by SHA-1 to generate the 2fa codes which is the standard for HOTP (RFC4226) and TOTP (RFC6238). While SHA-1 may not be perfectly uniform, SHA-1 is nearly-uniform and close enough to uniform that frequency analysis is not a feasible attack. Therefore, any non-obvious key such as an easy-to-remember phrase or sentence can be used to encrypt the 2fa codes.

Answer 2

One idea I had was to apply some sort of simple process (or cipher) to the backup codes so they are obscured, but able to decoded by remembering the process. Perhaps something like ROT13 or xor. After that, you'd print them on a business card template and set them as contact info. This boils down to security through obscurity, but at least partially helps with the problem.

Answer 3

Storing them on your person is a Bad Idea.

Backup codes are bypass passwords. They are essentially a backdoor through to your 2FA-secured account. They are more powerful than the regular account password.

With this in mind, you should consider whether you want to keep them around at all. After all, if backup codes exist, they become more valuable than your account's password. Your account would be more secure if none of those backup passwords exist: they are the antithesis of why 2FA exists in the first place. You should treat them as first-class passwords. Do you carry your regular passwords in written form in your wallet?

There is a very high chance these codes are for your GMail account, or your iCloud account, or your Amazon account... There is no need to specify what service they are for, the most common and obvious are going to be tested and most probably the thief will be right. With this being said, I don't think there is a best practice for this.

I (only partially) disagree with the answer advising to use a one-time pad for backup codes. Doing this requires you to generate and remember as many keys as you have passwords, which amounts to as much as remembering the passwords themselves. Whether the keys can be easy-to-remember passphrases or not, you can only remember so many (and usually you get backup codes in batches of ten, and you can't write down the keys). If you insist on writing backup codes down, then consider this solution.

But my advice is, if you really must keep backup codes on "yourself", consider learning one (or two) per service and disabling the rest. Please don't write them down.

Answer 4

I'd suggest storing them in a breakable opaque plastic container like Is used for the American presidents nuclear launch codes.

That way they can only be used by breaking the container making it difficult for the codes to be duplicated or used without your knowledge.

If only I could work out where to source them.