(untitled)

how do you keep your 2fa backed up? save qr codes before scanning?

>>3688 There are typically 2fa tokens you can back up, plus a lot of them have a way you can remove with a specific phrase / password. This is a good question though, I'm curious about any ways people typically back up their 2fa. For example, I back up my ~/.ssh and other secure data on multiple offline physical storage devices. Some people store all their info on paper, and I've seen some people put their stuff on remote servers, personally I wouldn't trust it.

I screenshot the QR codes and store them offline. Simple and very easy to reload onto a new device.

Those QR codes are normally just seeds for sane OTP algorithms (deterministic chains). Non-sane algorithms should be deprecated. Just print out the seed or the QR and put it in a safe.

I use andOTP on my phone, which encrypts my 2fa accounts with gpg before exporting the accounts file, and it is saved on my Nextcloud instance, which is backed up regularly. OpenKeychain + Password Store + andOTP from F-Droid is one of the safest ways to protect logins with your phone.

with shamir shared secrets: apt-get install ssss $man ssss-split $man ssss-combine

I screenshot them and then gpg encrypt the image file and store in a folder. As someone else mentioned, andotp android app will store the seeds as a json too which is cool.

>>3695 Shared secrets are prone to many flavors of fault attacks though. Vanilla shamir is easily breakable, all subsequent 'improvements' have also been broken, only with a higher degree of effort. Don't know much about online safety of said secret sharing.

>Vanilla shamir is easily breakable sauce? I'm not too well-versed on shamir secret sharing but based on what I could find from a search it's only really vulnerable if shares are revealed asynchronously.

>>3690 Yeah I'm pretty sure its better practice to backup the tokens instead of the seed and settings for the 2fa codes. If you lose access, just use one of the tokens to disable and re-enable 2fa with a new seed that you can save. It's also easy to detect when someone unauthorized uses the tokens as opposed to the 2fa generator.