Question What’s the best place to securely store my 2FA recovery codes for my accounts?

[Minimalist]

I store my recovery codes in my password manager (Keepass) and don't store them online.
If I would ever decide to store them in cloud I would probably make some adjustments to them. Like switching first and last character of each code.
That way even if someone gets hand on them they are not useful to them.

 

[Halp2001]

After carefully considering all suggestions, I have a few questions:

• Members who encrypt files before uploading them to an online backup service: do you use a unique password for each file, and where do you store these passwords?
• What secure and private cloud storage service would you recommend for storing plain-text files, ensuring that the provider can be trusted not to access unencrypted data?
• Is using an encrypted note-taking app like Standard Notes a better option than using cloud storage?

If you already use a password manager, it is probably the most practical option for storing both your recovery codes and the passwords for any encrypted files.

For ZIP/7z files, using a unique password for each file is a good practice, but it is important to have a secure way to store those passwords. A password manager is designed for managing this type of sensitive information.

Regarding storing files in the cloud, the most important point is to encrypt them locally before uploading. In that case, the security mainly depends on the encryption and the password used, not only on the storage provider.

Standard Notes is also a good alternative if you prefer keeping encrypted notes separately, although in practice a password manager can already fulfill that role and avoids maintaining two different systems.

 

[n8chavez]

They are in my Enpass Password manager, hosted at a personal cloud. Not in the Mainstream password managers Azure or AWS cloud.

Or better yet, use Enpass stored locally and bypass the cloud all-together. Databases can still be synced via wifi-sync, just start and stop the sync server on-demand.

 

[RoboMan]

Aforementioned in my previous post, secure notes in my password manager is, IMO, the most practical way to store 2FA recovery codes, combining security/practicality.

Why?

• The codes are encrypted at rest. Bitwarden, in my case, encrypts your vault locally before the encrypted vault data is stored. So you're not simply putting recovery codes into a normal cloud document, email, Google Drive, Notes app, etc.
• It's practical. If I lose my phone, lose my authenticator, replace my device, or get locked out of an account, I can access the recovery code from another trusted device by logging into Bitwarden. That's particularly useful because the whole point of recovery codes is that they need to be available when your primary authentication method isn't.

So, as long as my Bitwarden master password is unique, random, and strong, my recovery codes lie safe. As well, my password manager is protected by 2FA.

As well, Bitwarden uses a zero-knowledge / end-to-end encrypted vault architecture, so I have nothing to worry about. This includes even potential breaches or hacks. Even if my encrypted vault is leaked or sold, without my master password is just useless. Not even Bitwarden can access it.

 

[n8chavez]

Just to be clear, we're talking about saving an exported txt version of 2fa codes into some sort of notes function right? I hope so, because using an integrated password manager for 2fa codes kind of defeats the purpose of 2fa. I have to idea why password managers even offer that features. It's dumb. You're better off going with something like Proton 2fa.

 

[lokamoka820]

Just to be clear, we're talking about saving an exported txt version of 2fa codes into some sort of notes function right? I hope so, because using an integrated password manager for 2fa codes kind of defeats the purpose of 2fa. I have to idea why password managers even offer that features. It's dumb. You're better off going with something like Proton 2fa.

Yes, I'm asking about the recovery codes that online services provide when you enable two-factor authentication (2FA), the codes that allow you to regain access to your account if you lose access to your 2FA app.

 

[Zero Knowledge]

.exe or password protected .zip or 7zip. If your compromised somehow on your PC or in real life it doesn't matter which you choose. You could always it down on paper.