Comment on Authy got hacked, and 33 million user phone numbers were stolen
kambusha@sh.itjust.works 2 months agoI think the suggestion here is to back up Aegis. I do something similar using Aegis + SyncThing.
I have a folder on my phone that is synced with my PC. Every so often, I will back up Aegis to that folder, and then it automatically syncs to PC.
9point6@lemmy.world 2 months ago
Oh, in that case it’s not quite equivalent, because my cloud storage is protected by the two factor code stored in my Authy OTP database.
I would still need to access the OTP database before I could access the cloud storage, which is where it would be stored in this scenario.
WhatAmLemmy@lemmy.world 2 months ago
Forget your existing cloud. Your 2FA backup doesn’t need to be protected by 2FA; just encryption and a strong/unique passphrase. Most OSS E2EE services allow you to create a free account; many without an email. Pick 2 for redundancy, create a new account, and set a NEW passphrase (like your 2nd “master” password). Before you transit upload your OTP backup to both of them. Your 2FA backup can’t be used to access any account on its own, without each password.
This approach is probably more secure than SMS to access 2FA, especially from a closed source provider like Authy. If you’re already using a password manager and unique passwords for everything, you’re already 95% more secure than everyone else, and removed the primary need for 2FA (password reuse and theft). If you’re doing everything else right, 2FA only makes you 5-10% more secure, and covers you for less-likely threats. Sys admins have been raw dogging SSH and PGP keys every day without a 2nd factor, for decades.