Contents
Is Google backup codes safe?
Backup codes are static like passwords, but they don’t have some of the security problems. They generally have a high enough entropy to make remote brute forcing infeasible. Users don’t reuse backup codes like they reuse passwords, and backup codes don’t appear in common password dictionaries.
Where should you store recovery codes?
That is, keeping the codes in a piece of paper, or small pieces of paper for each code, may be the best option IMHO. Clearly encrypting it and storing it in the cloud or in a separate computer/device/usb may work, but eventually you need to decrypt and access these codes in plain text.
How does secure key work?
The Secure Key generates a temporary code which you then use to access mobile and online banking. To generate the code, you need a PIN or password known only by you – or you can use Touch ID, Face ID or Android Fingerprint if your device has these features. The Secure Key means only you can access your accounts.
How to store TOTP secret in the database?
Combine both methods: Combine the password with a locally stored key, and use this as the encryption key for the TOTP secret. This way, if the database is leaked and the attacker knows the password, they still can’t decrypt the TOTP secret unless they have access to the stored key
Is there a way to encrypt the TOTP secret?
Encrypt the TOTP secret using key stored on the server: This wouldn’t be ideal since you’d be encrypting everything with the same key, but a database can be leaked without the attacker having full access to all files on the server. In that scenario, at least the TOTP secrets are still protected.
How do you generate TOTPs in Bitwarden vault?
Edit the Vault item for which you want to generate TOTPs. Tap the camera icon in the Authenticator Key (TOTP) field. Scan the QR code and tap Save to begin generating TOTPs.
Do you need to have TOTP for Bitwarden authenticator?
Authenticator key (TOTP) storage is available to all accounts. TOTP code generation requires Premium or membership to a Paid Organization (Families, Teams, or Enterprise). If you’re new to using TOTPs for Two-step Login, refer to the Field Guide to Two-step Login for more information.