Do you download your RECOVERY CODES?

Every time you enable 2FA on any account, the service provider offers you to download a limited set of RECOVERY CODES and keep them very securely, should you lose access to your 2FA.

Similar process is followed for passwords, where a recovery email or phone number is required.

I was going through reviews of some 2FA apps, and some of the users lost access to thier accounts they have been using for several years, because something caused their 2FA apps to stop working (could be user's fault too).

If this happens to you, your only way to recover your account is through the RECOVERY CODES.

Have you downloaded them for your accounts and kept them safe?

TheMystic said:

Have you downloaded them for your accounts and kept them safe?

Click to expand...

Not once

z3r010 said:

Not once

Click to expand...

I haven't done it for quite a few accounts. It is only now that I have taken note of this 2FA app failure risk. Time to download the recovery codes for all my accounts, zip them with password and store it safely.

TheMystic said:

I haven't done it for quite a few accounts. It is only now that I have taken note of this 2FA app failure risk. Time to download the recovery codes for all my accounts, zip them with password and store it safely.

Click to expand...

I generally have a backup authentication method wherever possible sms/yubikey etc anyway, also I use Authy as my authenticator so the risk of failure is very low.

Indeed I do. Always make sure I have it stored somewhere safe...just in case...

Nope

email yourself the codes.. I don't use 2fa myself, but like send info to my e-mail accounts

TheMystic said:

Every time you enable 2FA on any account, the service provider offers you to download a limited set of RECOVERY CODES and keep them very securely, should you lose access to your 2FA.

Similar process is followed for passwords, where a recovery email or phone number is required.

I was going through reviews of some 2FA apps, and some of the users lost access to thier accounts they have been using for several years, because something caused their 2FA apps to stop working (could be user's fault too).

If this happens to you, your only way to recover your account is through the RECOVERY CODES.

Have you downloaded them for your accounts and kept them safe?

Click to expand...

I've never bothered with that and in fact I never would. It would be a lot easier and simpler to just do a password reset with my password manager.

retiredat44 said:

email yourself the codes.. I don't use 2fa myself, but like send info to my e-mail accounts

Click to expand...

Not a good idea, unless your email is end to end encrypted.

TraderGary said:

I've never bothered with that and in fact I never would. It would be a lot easier and simpler to just do a password reset with my password manager.

Click to expand...

That sounds like a good idea. So if we don't have access to the 2FA codes, will 'forgot password' work for certain (if we have a recovery number or email setup already)?

TheMystic said:

That sounds like a good idea. So if we don't have access to the 2FA codes, will 'forgot password' work for certain (if we have a recovery number or email setup already)?

Click to expand...

Yes, it works for me. I like to do occasional password resets on financial accounts. For 2FA I prefer to use Microsoft Authenticator. If MS Auth isn't available on a site, 2FA is always there on text messaging. You can always play "what if" and try it out first on a few of your sites.

Yes, I always save my recovery codes. I once had to use one on another 2FA site. Can't remember the reason now. It is just one more added precaution against losing 2FA site access.

Just my personal choice. Have a great day.

Regards,
Phil

Yes. I save them to a password protected file under OneNote. If you lose access to the original 2FA authentication method then these codes would be needed to access the account.

I download recovery code only for those account for which I care the most such as:
- my email
- MS account
- PayPal
- GitHub
- Steam
and similar web sites or services.

I keep those code on external drive to make sure if PC is compromised, they're still in safe place and out of hacker's reach.
In addition to recovery codes I also set up authenticator codes on my phone by scanning QR image on service provider, and if that's not possible then SMS authentication is good as well.

Passwords alone are not enough for important accounts.
Recover codes alone are also not enough without phone authentication because hackers can regenerate them if they gain access to your online account.

I store my recovery codes as notes in my password manager. I periodically dump and print my password database, storing one copy in a safe deposit box and one copy with my attorney.