Yesterday, I accidentally removed an authenticator app from my phone. Fortunately, I have another copy of the app on a different device. It made me realize how easy it is to lock myself out of my accounts. Do you think it’s a good idea to create a Windows VM with an Android emulator on it and install copies of all my authenticator apps, this will not cause any security issues?

  • usrdef@alien.topBEnglish
    2·
    1 year ago

    You should be backing up your secrets to some type of app like Vaultwarden or KeePassXC.

    And you shouldn’t need to VM host an android OS just to have a secondary means of authenticating. There are plenty of apps out there that support adding your secrets.

    Vaultwarden, Bitwarden, KeePassXC, or hell, a Yubikey 5 device and then use Yubikey Authenticator.

    • detalferous@lemm.eeEnglish
      1·
      1 year ago

      How do you back up your secrets? Do you have to do it at the time you first see them?

    • CubeRootofZero@alien.topBEnglish
      1·
      1 year ago

      I think that would be the best option for what the OP is looking for. A web accessible version for OTP codes. Problem is then you have to protect that page somehow. That repo shows it can use Yubikeys for AuthN, which IMO is the best way to protect it.

      I personally put my TOTP seeds in Vaultwarden. Then they sync over to whatever device I’m on. Just protect your Vault login however you need per device.

  • horkyze@alien.topBEnglish
    1·
    1 year ago

    Use the aegis authenticator. Its opensource an you can setup periodic export of encryptrd 2fa vault. Then you can integrate it into your existing backup flow

  • myeyehurtsrn@alien.topBEnglish
    1·
    1 year ago

    I use Authy 2FA because it syncs across my devices so I have the codes on my PC & phone. Would definitely recommend!

  • zandadoum@alien.topBEnglish
    1·
    1 year ago

    why not consolidate your auth apps?

    i use selfhosted vaultwarden (with backups ofc) for everything, except for vaultwarden, which is protected by authy . and authy can be backed up easily

    • -quakeguy-@alien.topBEnglish
      0·
      1 year ago

      Sane MFA apps explicitly disallow their data from being backed up. That would be a massive attack vector if it was possible.

      • guptaxpn@alien.topBEnglish
        1·
        1 year ago

        Which is exceedingly dumb IMHO. Sure it would be a vector, but it’s a vector to something that should be an additional step to username and password. Idk, I use vaultwarden and find myself worrying less about “what if?”. I’m also enabling TOTP far more often now that I can easily add it to my phone and have it sync to other systems.

  • mtojay@alien.topBEnglish
    1·
    1 year ago

    for semi serious accounts i use the inbuild totps from bitwarden premium (knowing full well that if someone gets access to my bitwarden he gets access to those accounts - but its just sooo damn convinient)

    for super serious accounts i use yubikeys (3x) with fido2 if supported and if not at least totp through yubikey with their app.

  • wally40@alien.topBEnglish
    1·
    1 year ago

    I self host Vaultwarden and when adding the QR, I add it to my free account with LastPass Authenticator app at the same time. Both back up so if my phone dies, I don’t lose the 2fa.

  • rglullis@communick.newsEnglish
    1·
    1 year ago

    Just use a sane authenticator app that lets you export the keys, and backup those safely.

    I’ve been using aegis which is available on F-Droid. Whenever I add a new “critical” account I make a backup of the data. That’s it.

  • TBT_TBT@alien.topBEnglish
    0·
    1 year ago

    That is the reason why I don’t self host my password manager: my 2FA passwords are in there, very conveniently and independently of any other device. I trust 1Password with that.