Two Factor Setup

STRONGEST ──────────────────────────────────── WEAKEST

FIDO2/WebAuthn  >  TOTP App  >  Push Notification  >  SMS/Voice
(Hardware key)     (Authenticator)  (App prompt)        (Text message)

Phishing-resistant:  YES        NO         NO              NO
Requires internet:   NO         NO         YES             YES
SIM-swap proof:      YES        YES        YES             NO

Step 1: Install authenticator app
  - Download from official app store only
  - Set up app lock (biometric or PIN)
  - Enable encrypted backup if available

Step 2: Enable 2FA on an account
  1. Go to account's Security Settings
  2. Find "Two-Factor Authentication" or "2-Step Verification"
  3. Select "Authenticator App" option
  4. Scan QR code with your authenticator app
  5. Enter the 6-digit code to verify
  6. SAVE the backup/recovery codes immediately

Step 3: Save recovery information
  - Screenshot the QR code (store encrypted, offline)
  - Copy the secret key text (store in password vault)
  - Save backup codes (print or store in vault)
  - Test the code works before closing setup

When setting up TOTP, the service shows a QR code.
That QR code encodes a URI like:

  otpauth://totp/Service:user@email.com?secret=JBSWY3DPEHPK3PXP&issuer=Service

The "secret" value is what generates your codes.

Backup strategy:
1. Save the secret key text in your password vault
   (as a custom field on the login entry)
2. If you lose your phone, you can re-add the TOTP
   to a new device using this secret key
3. Some apps (Aegis, 2FAS) support encrypted export
   of all TOTP entries - do this monthly

Step 1: Buy TWO keys (primary + backup)
  - Different form factors if possible
    (e.g., USB-C primary, USB-A + NFC backup)

Step 2: Register both keys on every account
  1. Go to account Security Settings
  2. Add Security Key (primary)
  3. Touch the key when prompted
  4. Name it: "YubiKey Primary - USB-C"
  5. Add Security Key (backup)
  6. Touch the backup key when prompted
  7. Name it: "YubiKey Backup - USB-A NFC"

Step 3: Store the backup key securely
  - Home safe, safety deposit box, or trusted person
  - NOT in the same bag as your laptop

Step 4: Also keep TOTP as a fallback method
  - In case both keys are unavailable
  - Some services require a backup method anyway

High-value accounts that support FIDO2:
├── Google / Gmail
├── Microsoft / Outlook
├── Apple (iCloud) - with passkeys
├── GitHub
├── Facebook
├── Twitter/X
├── Dropbox
├── Cloudflare
├── AWS
├── 1Password
├── Bitwarden
├── Coinbase
├── Stripe
└── Many more (check dongleauth.com for full list)

CRITICAL (do these first):
├── 1. Email accounts (recovery path for everything)
├── 2. Password manager
├── 3. Financial accounts (banking, investment)
├── 4. Cloud storage (Google, Apple, Microsoft)
└── 5. Domain registrar (if you own domains)

HIGH PRIORITY:
├── 6. Social media (identity theft vector)
├── 7. Work/employer accounts
├── 8. Developer accounts (GitHub, AWS, npm)
├── 9. Crypto exchanges
└── 10. Phone/carrier account (SIM-swap protection)

MEDIUM PRIORITY:
├── 11. Shopping (Amazon, with saved payment)
├── 12. Streaming services
├── 13. Gaming accounts
└── 14. Forums and communities

For each account:
  [ ] Enable strongest available 2FA method
  [ ] Save backup codes
  [ ] Register backup security key
  [ ] Update password vault entry with 2FA status

When you enable 2FA, most services give you recovery codes.

Storage Strategy (3 locations):
1. Password vault - in a secure note or custom field
2. Printed copy - in a home safe or lockbox
3. Encrypted file - on an encrypted USB drive

Recovery Code Template:
┌────────────────────────────────────────┐
│  Service: Google (user@gmail.com)      │
│  Date: 2025-01-15                      │
│  Codes:                                │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│    xxxx-xxxx-xxxx  [ ] Used            │
│  FIDO2 Keys Registered:               │
│    Primary: YubiKey 5C NFC             │
│    Backup: YubiKey 5 NFC              │
│  TOTP App: Aegis (Android)             │
└────────────────────────────────────────┘

When switching to a new phone:

BEFORE wiping old phone:
  [ ] Export TOTP entries from authenticator app
  [ ] Verify cloud backup of authenticator app is current
  [ ] Test that FIDO2 NFC keys work with new phone
  [ ] Ensure password vault app is on new phone and synced

On new phone:
  [ ] Install authenticator app
  [ ] Restore from encrypted backup OR re-import secrets
  [ ] Test 2FA login on 3 critical accounts
  [ ] Verify all entries are present (compare count)

After verification:
  [ ] Factory reset old phone
  [ ] Remove old phone from trusted devices on key accounts

Passkeys replace passwords entirely:
- Based on FIDO2/WebAuthn standard
- Private key stays on your device, never sent to server
- Phishing-proof by design (tied to specific domain)
- Biometric unlock (fingerprint, face) instead of typing
- Synced across devices via platform (Apple, Google, Microsoft)
  or password manager (1Password, Bitwarden)

Step 1: Check if your password manager supports passkeys
  - 1Password: Yes (recommended for cross-platform)
  - Bitwarden: Yes
  - Apple Keychain: Yes (Apple devices only)
  - Google Password Manager: Yes (Chrome/Android)

Step 2: Create a passkey on a supported service
  1. Go to account security settings
  2. Find "Passkeys" or "Sign-in methods"
  3. Click "Create passkey"
  4. Choose where to store it (password manager or platform)
  5. Authenticate with biometrics
  6. Passkey is created and stored

Step 3: Keep a backup authentication method
  - Passkeys are still new; keep password + TOTP as backup
  - Register passkeys in your password manager for cross-device access