Hacker News Reader

Comment by supernova87a | Hacker News Reader

I don't know about you but does anyone else screenshot (and even print physical copies of, to keep safe) their authenticator barcodes given by websites, in case some day your chosen app dies or your phone(s)/tablets/everything gets lost?

View on HN

I store my password manager (Bitwarden) TOTP code in my safe in QR code format. I keep all my other TOTPs in my password manager.

My Bitwarden password is long (at least 40 characters long, I didn't count precisely) and never used or reused.

Doesn't it kinda defeat the point of storing TOTP codes in your password manager?

You wouldn't need to store the codes, but you would need to store the key that makes the codes.

If it's secured by TOTP and a unique and secure password, it's not the weakest link.

This reduces the attack scope from two devices to one. If your computer or web browser is compromised then both your TOTP secrets and password secrets are in one basket. Storing TOTP on a separate device can make it significantly harder to compromise your accounts.

He might be using two different password manager accounts, one for passwords and one TOTP? Although it doesn't help much if he logs in from the same machine anyway.

I would say not when you can secure bitwarden with a hardware key 2FA.

Partially, but it still offers protection against e.g. replay attacks and e-mail hacks.

Aegis has an option to export an encrypted backup of the database. I export one every time I add a new code to the app.

One of the authors here. Recent versions of Aegis also come with an automatic backup feature, so that an export is created at a location of your choosing automatically every time a change is made to your entry list. Might be a little more convenient than doing manual exports every time.

Thanks for pointing this out! I've been using Aegis for quite a while and didn't know this.

Yes, and the exact reason I use aegis (plus open source!)

I use Aegis, but also import the TOTP URI to pass, and use it with pass-otp[1].

It kind of defeats the purpose of 2FA, but I keep my pass repo relatively secure, and the convenience is worth it.

[1]: https://github.com/tadfisher/pass-otp

That's really what scratch codes are for.

Yes, but not every service offers recovery codes.

That’s like a must. Services that don’t probably have an easy way to reset your 2FA via email verification which entirely negates the benefit of 2FA (last line of defence if your password or email are compromised). You probably want to stay away from those services entirely.

Always keep a hardcopy in a safe, for that day your phone is lost or dies. You don't wanna ask Amazon to remove your 2FA, as this involves paperwork. I learned the hard way, but luckily located backups

I put them into Bitwarden alongside the password.

Yes, that means that there's a single place where both factors are stored but if Bitwarden has two-factor authentication (it does), the two factors are preserved.

You really only not do this once. When you lose your phone, you learn.

You can use the QR codes to enroll new devices. (But then so can anyone who finds your QRs, so if you do this, keep them safe)

I keep screenshot of QR Codes, & phrases itself in a separate keypass database.

I sometimes do that when I don't have to write them down.

Yes I do keep backups.

Reply on news.ycombinator.com