Yesterday, I accidentally removed an authenticator app from my phone. Fortunately, I have another copy of the app on a different device. It made me realize how easy it is to lock myself out of my accounts. Do you think it’s a good idea to create a Windows VM with an Android emulator on it and install copies of all my authenticator apps, this will not cause any security issues?
You must log in or register to comment.
You should be backing up your secrets to some type of app like Vaultwarden or KeePassXC.
And you shouldn’t need to VM host an android OS just to have a secondary means of authenticating. There are plenty of apps out there that support adding your secrets.
Vaultwarden, Bitwarden, KeePassXC, or hell, a Yubikey 5 device and then use Yubikey Authenticator.
How do you back up your secrets? Do you have to do it at the time you first see them?
Instead of an android emulator, you could self-host a 2FA web app like https://github.com/Bubka/2FAuth
I think that would be the best option for what the OP is looking for. A web accessible version for OTP codes. Problem is then you have to protect that page somehow. That repo shows it can use Yubikeys for AuthN, which IMO is the best way to protect it.
I personally put my TOTP seeds in Vaultwarden. Then they sync over to whatever device I’m on. Just protect your Vault login however you need per device.
why not consolidate your auth apps?
i use selfhosted vaultwarden (with backups ofc) for everything, except for vaultwarden, which is protected by authy . and authy can be backed up easily
Instead of authy, may I suggest Ente Auth. It works the same as authy but is open source.
I backup the data but not the apps
Sane MFA apps explicitly disallow their data from being backed up. That would be a massive attack vector if it was possible.
Which is exceedingly dumb IMHO. Sure it would be a vector, but it’s a vector to something that should be an additional step to username and password. Idk, I use vaultwarden and find myself worrying less about “what if?”. I’m also enabling TOTP far more often now that I can easily add it to my phone and have it sync to other systems.
Use the aegis authenticator. Its opensource an you can setup periodic export of encryptrd 2fa vault. Then you can integrate it into your existing backup flow
That is the reason why I don’t self host my password manager: my 2FA passwords are in there, very conveniently and independently of any other device. I trust 1Password with that.
I trust 1Password with that.
Oops. https://www.darkreading.com/remote-workforce/1password-latest-victim-okta-customer-service-breach
lol. did you really read the article you linked?
So? No customer data got leaked. And even if the vaults would get leaked (which they didn’t), they are 2FA encrypted.
2fa is not encryption.
Encrypted and 2FA protected.
I use the totp in keepassxc for Backup and PC use
I use Authy 2FA because it syncs across my devices so I have the codes on my PC & phone. Would definitely recommend!
for semi serious accounts i use the inbuild totps from bitwarden premium (knowing full well that if someone gets access to my bitwarden he gets access to those accounts - but its just sooo damn convinient)
for super serious accounts i use yubikeys (3x) with fido2 if supported and if not at least totp through yubikey with their app.
Ente Auth - an Open Source E2E 2FA Cloud app. It even has a web app. Highly recommended.
I self host Vaultwarden and when adding the QR, I add it to my free account with LastPass Authenticator app at the same time. Both back up so if my phone dies, I don’t lose the 2fa.
Just use a sane authenticator app that lets you export the keys, and backup those safely.
I’ve been using aegis which is available on F-Droid. Whenever I add a new “critical” account I make a backup of the data. That’s it.
