Comment by cowlevel
5 days ago
I've had nothing but bad experiences with TOTP. Mostly involving dead phones and having to find the backup codes.
5 days ago
I've had nothing but bad experiences with TOTP. Mostly involving dead phones and having to find the backup codes.
You can back up the TOTP secrets to add another layer of protection. I haven't needed to restore from backup yet, but I'm pretty confident that failure mode won't be a problem outside the immediate timeframe my phone happens to die.
The TOTP secret then becomes a password.
Just as your recovery codes already are. It's all just passwords with extra steps.
I don't know my TOTP secrets. They're far too long for me (or any reasonable human) to memorise them. The only way to use them is to have physical access to them (unless I post them publicly on the internet, which I don't).
My first factor is 'something I know'. That it my password to my password manager. My second factor is 'something I have'. That would be my 2FA codes/secrets. I keep backups of both. Someone getting access to my 2FA secrets is extremely unlikely short of someone breaking into my house and stealing my encrypted NAS or my second encrypted backup. That's not a threat I intend to counter with my threat model. On the other hand, getting locked out of an account is a threat I do intent to mitigate, and thus, not having backups is not a viable alternative for me.