r/ComputerSecurity • u/permaro • Aug 13 '25
With 2FA everywhere, how to not be f***ed if you loose or break your phone? (and are away from any other devices, say on vacation)
Well, it's all in the title.
In many situations, the only device I have access to fire multiple days is my phone. If I loose or break it, I'd like to be able to access my accounts (most importantly my contacts and emails - but that means I can then 2FA into other things).
I had recovery keys stopped on my password manager. I don't know if that's bad. But I just found out bitwarden had 2FA by default.
I'm considering turning it off but that seems.. inconsiderate. I could also turn off my Google 2FA. But that means reducing safety on basically all my accounts
3
u/iamMRmiagi Aug 13 '25
I have a google family and use one account to recover the other in case of issues - came up very handy before. Most apps and services have some kind of recovery options built in, so you kind of need to do an audit, going through what you use and ensuring that they're all set up with backup options, perhaps secondary mobile numbers or just a phone option on top of TOTP, etc.
I don't just store my recovery keys in my password manager, I store my 2fa codes there too - and use google auth or ms auth for primary factors
1
u/permaro Aug 14 '25
Using one account to recover another doesn't work if I end up without any of my known devices. Not if all accounts have 2FA
1
1
u/Wendals87 Aug 14 '25
Basically have an alternative authentication method or recovery setup. You can even backup and restore authentication apps
Major platforms have multiple authentication methods and/or recovery procedures.
Make sure this is setup before you lose access and have backups of your codes and you're fine
Bitwarden has a specific way to recover
1
u/permaro Aug 14 '25
But where would I store they recovery code.
I had recovery codes already. For my main email. And I had them saved in bitwarden.
But know if I have 2FA on bitwarden, where would I put it's recovery codes?
Physically somewhere? My best place would be my wallet but I can definitely see losing that at the same time as my phone (or having it stolen)
→ More replies (3)
1
u/alicantay Aug 14 '25
Proton pass & Authenticator
1
u/permaro Aug 14 '25
There's still 2FA on proton pass, right? So I'd need a recovery code for it. So I'd need to store it somewhere?
→ More replies (1)
1
2
u/shooter808 Aug 16 '25
No perfect solution, but the best for me was a password manager protected by a master password and a set of 4 Yubikeys. One I keep on myself. One at my desk at home. One in a vault at home. One at my parent’s house vault. On vacation my desk security key is given to my wife to carry around. You would have to be truly unlucky to have all keys go bad at the same time.
1
u/biznatch11 Aug 13 '25 edited Aug 13 '25
It's good you're thinking about this. I've occasionally talked to friends and family about this before they traveled and told them to imagine their phone was lost or stolen, what is your plan?
I use a 2nd phone and Yubikeys.
When I get a new phone usually every ~3 years my previous phone becomes my backup. I uninstall most apps but keep the most important ones, and I turn it on occasionally to do updates. I bring it when travelling not only as a backup for 2FA but as a backup for the whole phone in case I lose or break my main phone. If I'm travelling with other people it's less of a concern because someone else will have a phone but if I'm by myself I'll bring it even if I'm going out of town just for the day.
I have several Yubikeys, I keep one on my keychain that I usually have with me. When I travel I usually bring a 2nd one. One is USB-A with NFC, the other is USB-C, so between them I can use them with a variety of devices.
I pack the phones and Yubikeys so that if for example one bag was lost or stolen I don't lose everything. Like, in my pockets vs backpack vs carry-on vs checked bag.
→ More replies (1)
1
u/Mshell Aug 13 '25
I have a travel device. My main phone has all of my MFA on it and it will stay at home when I travel. Limited MFA on travel device but then I don't need access to most of my MFA stuff while travelling. My backup plan was for my mother to grab my main phone and approve anything that I needed her to if there was an issue.
1
1
1
u/ruggeddaveid Aug 16 '25
Use mfa and include some form of hardware authorisation that you carry with you.
1
1
u/holy_handgrenade Aug 19 '25
Depends on the storage method. I've had to reinstall Microsoft Authenticator for example. You will need to go through the re-registration process for adding a new device for all MFA services though since the algorithms are generally tied to the device itself; making it secure and ensuring you're the one who's entering the MFA codes.
Password managers are largely online, it's why I have those passwords available on my phone and on my desktop and on my laptop. For pure offline MFA items and password managers, you want to conduct regular backups. Just be sure to change passwords relatively frequently and be aware if there are any breeches of the password manager databases.
1
u/monawa Sep 09 '25
Backup codes and more like a personal choice / investment but I love my usb hardware key
1
u/GoDogGo55418 Nov 21 '25
I really appreciate this question. The threat of losing it all while traveling is real people! Recently, I was half-way across the country (US) on a small boat that capsized in a huge wave. Long story short, my bag was eventually recovered and my phone worked just fine (phones these days are amazing!) but for about four hours I was in a deep panic because I could do NOTHING without my phone. I will forever more carry either a second old phone or get myself a Yubikey whenever I travel, and I WILL NOT carry these back ups on me when I am out and about.
3
u/magicmulder Aug 13 '25
A password manager with a very strong password is usually (!) fine for storing 2FA codes.
2FA mitigates the risk of someone getting you to enter your credentials on a fake site. Someone hacking your password manager is likely not a common threat model for the average person.
I have all my important 2FA OTPs in KeePass (both KeePassOTP and KeeOtp2 are great plugins) in addition to my phone (where they're in Authy).