this post was submitted on 22 Mar 2024
31 points (91.9% liked)

Privacy

32156 readers
882 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.

Searching for best practices didnt help so far. Thats why I turn to you.

So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.

Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.

If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.

Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.

Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?

Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 7 points 8 months ago (2 children)

Aegis is so great especially because it allows you to set an automatic backup every time you add a new TOTP. This way, a backup is made immediately after modifying the MFA vault, stored in your phone storage, where it can be grabbed by your synchronization system of choice (e.g., Syncthing), replicating the backup on your other devices, for example. This way, you can rest assured you will always have your MFA vault no matter what.

[–] [email protected] 1 points 8 months ago (1 children)

Do you need to externally encrypt the data or at least you the password field when syncing with syncthing? I mean, the traffic is encrypted already but still doesn't feel right.

[–] [email protected] 1 points 8 months ago

Syncthing encrypts the data, so it will be encrypted when being transferred. However, Aegis can export the vault into an encrypted file, too. So the vault file you will be transferring over an encrypted channel is encrypted itself as well. That means that the vault is secure even when at rest on some device.

[–] [email protected] 1 points 8 months ago

Thanks for this info! Very helpful!