Since your 2fa seeds are backed up, losing access to the device with the app on is not a problem.
Recovery codes would be useful if you lost the seeds. And you also would have to have those backup codes in a different place than your seeds, since then both of them would be lost.
Am I ignorant of something or are they pretty much useless ?
Oh, they’re very handy. I, and I’ve talked to several other folks who, for whatever reason, lost access to their 2FA codes/seeds.
Not going to go into incidents at work, but I’ll say what happened to me. Back… several years ago (I want to say about 10), my phones battery caught on fire. All my data, was lost. At that time, I was using a proprietary app, and it did require an account. I assumed that the app would automatically back up (that was its selling point), it did not. That feature had to be enabled, which I didn’t know (so, I essentially created the account for nothing). Several accounts were completely unrecoverable (including an old important email), but I could save a few, thanks to those codes.
Should also mention that some folks do not save their 2FA seeds to an app, but save them to a hardware key (eg: a Yubikey). These devices are prone to loss, theft, and so on. Recovery codes, again, come in handy.
I actually memorized one of the codes for a specific account in case I ever lost all my devices for some reason.
From that account I can rebuild/gain access to everything else. It’s kind of a fail safe.
That may sound weird to many people but for work I travel, including internationally, quite often. The danger that my devices while away from home could be destroyed/lost somehow is pretty real. Thus the idea that I could basically walk into a store, buy a new device, and then be up and running again at 100% helps me sleep at night.
That’s a nice use case! I was inclined to agree with wish3k but now i see the appeal of backup codes. It’s kind of a memorable 2FA. Still better than not having 2FA to your fail safe account at all.
I was locked out of an account once for seventy days. I took the term OTP way too literally and uninstalled the app I’d used to set up 2FA immediately after the first use.
This was some years ago, back before I fully understood what 2FA even was. A single recovery code could have saved me two and a half months of headache.
I’m using Raivo on iOS for 2FA codes which backups/syncs encrypted to iCloud. I’d like to move away from them and use my Yubikeys for TOTP as well.
I have two Yubikeys which I’ll use for that. Nevertheless it can happen that in case of a fire both of the keys are getting burned and I need a recovery/backup code.
Since I could backup the seed phrase, do I really should backup the recovery code?
Where do you guys store these and in what format?
Thanks in advance
2FA backup codes saved me after my phone broke. I was in between backups and didn’t have the latest seeds stored. After panicking for a bit, I realized I had printed out the recovery codes and put them in my desk, so after a couple of minutes pecking my keyboard, I had access to all my accounts again.
Recently, when i re-installed my desktop OS, the time was not synchronized properly and i could not notice as just few seconds difference. So I was not able to login to many of my accounts with 2fa codes (even tho i had full access to seeds and 2fa codes as well), there comes the Recovery Codes, i was able to login to those accounts without any issues. So no one knows when we have any kind of unknown errors, having a backup plan is always good.
Similar to @BlackHeart’s, I have heard of one case where someone, despite having the correct code and time, weren’t able to login. Something was most likely wrong on the server’s side, so they decided to use a recovery code instead and that worked.
Despite backing up the seed, I still recommend backing up the recovery codes. Recovery codes work no matter what and don’t require you to have a 2FA app or anything. You can back them up wherever you have storage, either physical or in the cloud. Consider encrypting them, especially if you are uploading them to a service that doesn’t do that already.