Comment by Telaneo
5 days ago
Just as your recovery codes already are. It's all just passwords with extra steps.
I don't know my TOTP secrets. They're far too long for me (or any reasonable human) to memorise them. The only way to use them is to have physical access to them (unless I post them publicly on the internet, which I don't).
My first factor is 'something I know'. That it my password to my password manager. My second factor is 'something I have'. That would be my 2FA codes/secrets. I keep backups of both. Someone getting access to my 2FA secrets is extremely unlikely short of someone breaking into my house and stealing my encrypted NAS or my second encrypted backup. That's not a threat I intend to counter with my threat model. On the other hand, getting locked out of an account is a threat I do intent to mitigate, and thus, not having backups is not a viable alternative for me.
No comments yet
Contribute on Hacker News ↗