2FA Backup Recovery

Use Authy. 2FA via account instead of device is hypothetically less-secure but as a practice for individual security, far better than being locked out of everything after the misfortune of losing a phone.

I have encrypted backups of all my 2FA secrets in two locations. I change phones every year and have never lost an account.

Use something like Authy. It supports Backup.Anyways, you are supposed to stash your recovery codes somewhere (not on the phone).

It’s a good question. A lot of 2FA apps have manual backup/restore functionality. Some have cloud sync (e.g. iCloud sync so your new iPhone has the same app and codes, or 1Password/Bitwarden which has you log back into the app on the new phone with their service login.) These 2FA syncs can be a point of weakness so not everyone uses them.The services themselves (rubygems etc.) also provide a short list of one-time account recovery codes. You’re supposed to essentially print them and

Likewise, it was not fun when my phone with GA suprise died. Many services with 2FA do not provide backup codes. I switched over to Authy for this reason--they allow an encrypted backup of the TOTP secrets.

One of the risks of 2FA is losing access to your accounts after losing the authenticating device. Backing up the 2FA seeds mitigates that risk. The backup needs to be encrypted with the password remembered and stored somewhere. Sounds like it’s a job for a password manager, preferably in an offline local password manager with a different database.

This seems like a bug, not a feature.Personally I have Authenticator for day to day use, a Yubikey for restoring access if something happens to my phone, and backup codes.

Why not use something like Authy that's backed up and has a recovery password? I just download it on my next phone and am good to go.

Not that I know of, but you should definitely at least enable a second form of 2FA like the recovery codes OR a second security key, then print/write/store the file/key somewhere. If you lose your primary, then you can use that secondary. Never just have 1 form of 2FA without a fallback.

1Password stores QR codes and syncs them across any device that has access to your vault. I highly recommend this solution if you're worried about losing access to your 2FA codes. It is also easy to back up.