I would like to know if it is fine to keep both general (such as personal email, personal drive, etc) & sensitive 2FA codes in the same 2FA app?
Is there any know vulnerabilities or should I keep it separate?
All my 2FA codes are in 1 app.. I can’t really think of anything so sensitive that it would warrant being in a separate vault. Maybe you could provide some further info / context?
Potentially there are some scenarios in which keeping different sets of codes in different apps could have privacy benefits.
For example, if you’ve got the personal codes in app A, and the sensitive ones in app B, a single compromise of either A or B doesn’t by itself reveal that the personal accounts and the sensitive accounts have the same owner, whereas it would do so if both sets of codes were in the same vault.
Is mitigating that particular risk worth the extra effort it takes to maintain 2 separate 2FA apps? In most cases I’d guess probably not, but I suppose it depends.
Yeah I suppose that makes sense, if you have another identity you are managing that cannot be tied to yourself. That requires an elevated level of opsec of course. That’s why I am curious though about OP’s situation, I can’t imagine many situations which would warrant such care. I
It’s simple, you use auth app i every identity so even if there’s same app for them you have separate databases.
Unless it’s one database in cloud.
I’d worry more about disaster recovery than privacy. How screwed are you if you lose access to you authenticator app? This happened to me, and nearly screwed me out of my login to Bitwarden, but luckily I had a backup 2FA method - a hardware key.
Yeah I would always advise keeping backups.
Personally I have Aegis auto-backup with any changes and then it backs up to multiple devices over Syncthing.
I also periodically back up to Proton drive.
The general idea is to split secrets and not put everything in one database. If one gets breached, the other one may not—but usually this depends on how you protect the two databases differently, like using two passwords that aren’t connected, or keeping them on different devices that aren’t connected.
To start off with better security and recoverability, I’d suggest keeping the passwords and the TOTP in different databases/programs/devices. Use different passwords to protect the password manager and the TOTP authenticator (or its backup). Don’t keep the passwords used to protect the TOTP authenticator in the password manager (keep them on paper, etc.). Keep the TOTP authenticator only on the mobile device where a full lift of the database is more remote. With this, you already achieve some kind of secret splitting.