Storing recovery codes securely

That is why I suggested creating a LUKS or Veracrypt container and storing the text files in there. As these things use transparent encryption of a mounted volume, that is in memory when it is open and not stored separate on the volume as an unencrypted file. You could attach that to a global password manager entry. This would be a better approach than using 7z, gpg etc, because that requires you to have a decrypted copy on the filesystem, unless you put it in ramfs (I wouldn’t decrypt into tmpfs because that could potentially be swapped to the disk).

That way it would be backed up by Bitwarden or 1Password or whatever. Unless you’re happy with making sure you have your own backup. Good to have one off site though in case of natural disaster.

1 Like