65
How you all prevent Password/OTP/TOTP deadlocks?
(programming.dev)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Apr 2024
65 points (98.5% liked)
Privacy
32169 readers
350 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
All my drives are encrypted and have an encrypted backup of 2FA, a whole bunch of drives and my phone would all have to fail at the same time. This is following 3-2-1 so not all are in the same place or running at the same time
I use veracrypt to make encrypted portable files that contain 2FA and I back them up to random cloud storage using simplelogin email accounts, no 2FA on these for this exact reason. I know my password manager passphrase but I also do the same thing with it as the 2FA file just on a different account.
If any of the accounts gets hijacked then all they have is a throwaway email and password for that account and a random tiny encrypted file.
My codes aren't labeled with the email that they are for, just the service, e.g Proton1, and the passphrase has no other information stored with it so even if they magically managed to decrypt either of the files and gain access to the codes/ passphrase they don't have any idea what accounts any of them are for.
Log in to a cloud storage -> download the file -> decrypt it -> add it to any compatible app -> login to the password manager