29
submitted 4 weeks ago* (last edited 3 weeks ago) by [email protected] to c/[email protected]

After everything that has happened with Raivo over the last few days it’s reminded me that I need to go through my accounts with 2FA enabled.

However, how do others keep things organised? My main 2FA app is Proton Pass but I’ll be adding Ente Auth as a backup alongside my Yubikey. In the past I saved a copy of the QR codes when setting up 2FA but I’d occasionally forget to save new ones.

Does anyone have a good system for saving either the QR code or setup code (not actually sure what it’s called) for future use?

EDIT: the code I’m referring to is the initial secret code used to setup the 2FA

Final Edit: I’ve settled on saving the QR codes into a folder that is setup as a git repo.

you are viewing a single comment's thread
view the rest of the comments
[-] [email protected] 7 points 4 weeks ago

Not a security scientist, but in my interpretation, it's the "categories" of the factors that matter. Ideally, you use some two of three of:

  • something (only) you know - generally represented by passwords
  • something (only) you have - most commonly represented by some device. you prove that you have the device by providing a token only that device can generate.
  • something (only) you are - generally represented by biometrics

the goal then is maintaining the "only"s.

if you tell someone your password, or they see you type it in, or they beat it out of you with a wrench, it's no longer something "only" you know, and it is compromised.

if you use the same password on two websites, and one website is compromised, the password is compromised.

OTPs from a key fob or yubikey or something are similarly compromised if the device that provides them is left out in public/lost/stolen/beaten out of you with a wrench.

biometrics are again, are compromised if it's not "only" you with access to them - someone scans you face while you're asleep, or smashes your finger off with their wrench.

having multiple factors in the same category, like having two passwords, or two otp tokens, or two finger prints, doesn't significantly improve security. if you give up one thing you remember, it's likely you'll give up more. if one fob from your keychain is stolen, the second fob on that keychain is of no additional help.

you can start shifting what categories these things represent though.

if you write down your password in a notebook or a spreadsheet, they become thing you have.

OTPs can become something you know if you remember the secret used to generate them.

knowing many different things is hard, so you can put them in a password vault. the password vault is then something you have, which can be protected by something you know. so although your OTPs and passwords are in one place, you still require two factors to get access to them.

you still need to protect your "only"s though. and don't put yourself in situations where people with wrenches want your secrets.

[-] [email protected] 1 points 4 weeks ago

Thank you for the detailed response!

this post was submitted on 02 Jun 2024
29 points (100.0% liked)

Asklemmy

42472 readers
1260 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago
MODERATORS