Hacker News new | ask | show | jobs
by bblough 3278 days ago
I keep mine in my password manager, which is sync'd across all of my devices. That way, if I lose access to my 2FA device, I can still get into my accounts, even if I'm traveling.
1 comments

Doesn't this make 2fa less secure for you? Assuming your password and your recovery codes are in the same place, that's only one factor auth.
In general, an attacker wouldn't be getting my password from my password manager, they'd be getting it through phishing, or brute force, or some other way. If they acquire my password in any way other than a total compromise of my password manager, then 2FA still protects the accounts.

If an attacker is able to compromise my password manager, then quite frankly, I have much bigger issues to worry about than my 2FA codes. But there are ways to make that harder, too. For example, some password managers also support 2FA (mine supports Yubikey).