35

Writing them to paper is one of the simplest, guaranteed to be safe from malware and hardware failure for the average people. If you have a password manager, usually you can store secure notes too, which can handle backup codes. But if you do that, then attackers who managed to breach your password manager now have everything they need to get into your ...


13

But the whole point of using password managers (yes, that's another thing) is that you don't have to write down all the passwords... Backup codes are distinct from passwords. Passwords are something you need every time you use the account. The danger of writing down passwords is they will naturally be near or even on your computer. Anyone with physical ...


6

Password hashing, like most cryptographic operations, is something you should never try creating from scratch, and should avoid even implementing from somebody else's design unless there's some reason you can't use a well-tested library. The obvious flaw in your scheme is that SHA256 is a fast hash, which means it's possible to attempt to brute-force it at a ...


4

As @Martheen says: If you have a password manager, usually you can store secure notes too, which can handle backup codes. But if you do that, then attackers who managed to breach your password manager now have everything they need to get into your account. Usually, you need to type your Master password several times per day(/hour). This implies: The ...


2

Using a password manager to generate the 2FA codes is certainly better from a resiliency standpoint than just having a single 2FA generator on a phone that can be easily lost or damaged. What the password manager actually stores and syncs is the initialization seed stored in the QR code, allowing any device you install the password manager app on to generate ...


2

Starting with the questions: Scripts can send CSRF requests (via XMLHttpRequest and fetch), not just forms and implicit GETs of page resources. However, there are very strong limits on what types of requests a script can send cross-origin. In particular, you can't send custom headers cross-origin at all unless the target origin (your site) sends a suitable ...


2

Your arguments seems to be based on the assumption that the majority of tracking is done based on the browser type - which it is not. It is instead based on simple things like cookies, Etag etc but also on more complex things like Javascript based fingerprinting. Such fingerprints do not only depend on the type of browser used, but also on capabilities of ...


2

There might exist, somewhere, something that does what you imagine, but it would never have widespread adoption and it would be a waste of time and resources. There are two reasons why: Kerckhoff's principle scalability Security systems are designed with Kerckhoff's principle in mind, so that the algorithm or process to secure something does not need to be ...


1

As stated in the previous answers, backup codes are meant to use in the future to authenticate and regain your access (if required). It has to be stored somewhere safely and should be accessible easily at anytime when required. Storing in a paper is a simple way but securing and keeping it all the time with you is a challenging task. Storing in password ...


1

One can scan the QR code with the two devices at once (in order to have a backup generator available as primary recovery option) - and then generally does not need recovery codes; I'd still keep them as a secondary recovery option. When already having enable 2FA for a single device, it's usually required to disable it, in order to scan twice when re-enabling ...


Only top voted, non community-wiki answers of a minimum length are eligible