I have read quite a few posts about preventing account password takeover from various malicious ways, and many OPSEC measures are there to prevent it from happening.
Consider a case where you face a total blackout or technical failure. Now, you need to log in to your password manager, which requires either OTP on email or TOTP. You don’t have access to the TOTP app because the backup is stored in cloud storage, whose email login also requires OTP.
How would you prevent such from happening?I haven’t found a satisfactory solution or explanation for that yet.
Oh this is a good post for me! This happened to me. I had my pc drive encrypted so when it boots, i need to provide it with the password before it boots my OS. I use bitwarden to store my passwords and my bitwarden needs my 2FA code to unlock.
I wanted to install the newest version of LineageOS on my phone so i backed up everything to my pc and made sure i had everything backed up properly.
Then i wiped my phone and downloaded the new LineageOS iso and had to put it on my phone using ADB. But it had an issue to where it wouldn’t detect the phone. So i thought “Let me reboot my PC real quick because that might fix it.”
Presses reboot… "Please type your password to decrypt your harddrive: "
Fuck…
I have never had a worse panic attack in my life. EVERYTHING was on that drive. My work, my photos, my bank info, my entire life was on that encrypted drive.
But my password was on bitwarden. And to unlock bitwarden i needed my 2FA. Which i had backed up on my drive… which was now encrypted and i couldn’t unlock anymore.
I absolutely fucking lost it.
I dug through the entire house and after almost 8 hours of searching i found one of my old laptops in a box in the attic. I suddenly i got the idea that MAYBE i had once backed up my phone stuff before because i ran the phone OS it came with and i then at one point installed LIineageOS.
I dug through every single folder and suddenly i found an old vault backup of the two-factor authenticator UNENCRYPTED app that i had used before.
I send it to my wife’s phone and imported it into the app. The ONLY account that was on there… was bitwarden.
After almost 14 hours of pure stress and panic, i was able to decrypt my harddrive.
So my PERSONAL advice is ALWAYS store a physical backup.
I don’t want to go through that stress ever again.
The only passphrases I actually fully remember are the ones for drive LUKS and for the password manager databases.
You backup your 2FA locally. Problem solved.
If you’re using the cloud for anything related to security you’re doing something wrong. (In my opinion)