Hacker News Reader

Comment by simonbarker87 | Hacker News Reader

Related: anyone have a good 2FA backup solution? Like if I loose my phone at this point I’d be pretty stuffed as my Google Auth app would be gone and my text 2FA also gone in the same moment.

View on HN

TOTP is based off of a shared secret, so keeping that secret backed up is possible. I keep all of my TOTP tokens in a keepass database that is synced to my computers. If my keepass database is ever stolen and the encryption defeated then I'd be hosed, but I have a feeling there would be much worse problems in the world on that day.

Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it.

I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario.

Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)

Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible.

My master password has hundreds of bits of entropy and only leaves my brain to enter it.

Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.

Sounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.

When you set up Google Auth for a site, you can capture the seed value and back that up. 1Password has TOTP (Google Auth protocol) support baked in if you're looking for a way to use TOTP without relying on a single physical device.

I use strongbox[1] on iOS and it has a feature to print off your entire database (automatically formats everything). The passwords are stored in a standard kdbx file that you can sync manually or use drive, iCloud, etc. KeepassXC[2] has browser extensions and cross-platform apps and pairs well with strongbox. (No print feature afaik) Both apps are open-source.

[1] https://strongboxsafe.com/ [2] https://keepassxc.org//

You usually have backup codes, you can print them, send them to yourself in your emails, have them in a passport manager, as notes, etc.

Sure, that’s a massive pain in the butt though. I’m thinking about something that allows me to get back up and running with the same system relatively quickly.

This. I am pretty scared of losing my phone too.

Reinstalling the app didn't seem to revive the tokens, last time I tried.

Yeh, 2FA through an authenticator app feels so fragile for the consequences of something going wrong.

And as far as I know you can only have one device enabled with Google Authenticator at a time?

If it could be on multiple devices then I could set up an old phone and have it as a backup.

Edit: I’m wrong. You can sync two Authenticator apps using the same QR code during setup.

You can export Google Auth tokens and reimport them on a separate device.

Authy seems to sync between the 2 devices I have with it installed (which indicates that it's stored "in the cloud").

I always have second device mirroring the important stuff on my primary device. Usually my most recently replaced phone.

As I was typing the question I thought “I guess my old phone could do the job?” I’m wondering there is a middle ground option.

There is the OTP extension[1] for Password Store[2], although it kind of defeats the point of 2FA to have OTP tokens stored alongside passwords. Might be best used as a backup?

[1] https://github.com/tadfisher/pass-otp

[2] https://www.passwordstore.org

I wouldn't trust closed source services for something this simple. Authy wants your phone number and Google wants anything it can get its hands on. There are plenty of open source options with backup options.

Use Bitwarden. You can back up everything into an encrypted JSON file - including your 2FA TOTP stuff. Import it into a self-hosted Bitwarden too, if you like.

EDIT: Exactly as petepete said. Multiple FIDO tokens like Yubikeys are supported.

I use BitWarden for 2FA via their paid plan (£10 per year).

My BitWarden account is secured by Yubikey, of which I have two.

Ok, think I need to look at Yubikey as it keeps coming up here. I have a paid LastPass account, maybe there is something in there I can use.

Yeah, you can lock your LastPass with it in the same way I do mine.

Knowing my passwords and 2FA are protected and backed up is a huge relief.

LastPass authenticator uses centralized (encrypted) storage of keys

iCloud Keychain works across devices, backed up automatically to iCloud. Only for Apple devices but works great.

Reply on news.ycombinator.com