(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate)
Back in the days defining a path leading to loss of data or loss of online accounts was easy: losing the user/pass was enough. Nowadays with two factor authentication involving SMS or token generators, the analysis of the possible ways of failure is more complex. This reasoning applies also to credit cards and similar stuff, since the locking of a credit card relies on calling a specific telephone number quickly, and probably providing additional data.
I would like to find a way to track them in a comprehensive way, at least for the most important accounts (basically, the ones that go beyond user/pass authentication).
Google accounts: either user/pass only, or (with 2FA) user/pass/[token generator|SMS|printed codes]. Now, most people keep the token generator in the smartphone: the loss of the smartphone MAY be sufficient to lock access to the account, if the codes have never been printed.
Dropbox: a vault with passwords could be stored on Dropbox (for example, 1Password does that). However it's common (if you use 1Password or equivalent like Lastpass) to store the Dropbox password in the vault. If the desktop computer gets stolen, accessing the dropbox account MAY be lost. Not to mention that Dropbox supports two factor authentication and things can get more complicated.
I thought about using a normal graph editor (OmniGraffle for example), but keeping track of the multiple paths is not easy.
My question is how to track the different paths that lead to failure, given than each account (or equivalent) may have multiple alternative paths, all of which must fail to permanently lock the account, and each path is made of several elements the failure of any of which will cause that path to fail.
Years later, I think that what I was looking for is probably "fault tree analysis" software, applied to passwords.
AND gates represent alternatives way to recover a password. For example, password manager on smartphone AND password manager on desktop AND web access to Dropbox/OneDrive/...
OR gates represent alternatives ways to completely lock a recover pathway. For example, to become unable to retrieve a password from the desktop PC: house on fire OR theft of desktop OR hard disk damage.
Since some blocks (access to smartphone) is required for multiple pathways (it is required for several 2FA, it is required for the password manager on the smartphone), the software could be able to give alternative pathways which lead to the final event (complete loss of password vault, or of a specific password in it).