C-05: Recovery phrase on paper, two factor with a key backup

Two halves, both required

Two factor makes a stolen password useless on its own. A key backup makes losing your own key survivable. Doing the first without the second trades one failure mode for another, which is why this item covers both rather than splitting them.

The recovery phrase

There is nobody to email for a reset, which is the same property that keeps a market from holding a file on you. The phrase is the entire recovery system and it only works if it exists outside your memory. Paper, stored away from the device, and never a photograph or a synced note.

The rule with no exceptions

No genuine login asks you to type the recovery phrase as part of signing in. A page that asks is collecting accounts. This is worth stating as an absolute because phishing pages present the request in reasonable sounding wrappers, and a rule with exceptions is a rule you will talk yourself past.

Key backup in practice

• Export the private key the day it is generated rather than eventually
• Store it offline, separately from the machine you sign in with
• Record the passphrase for the key wherever you keep the account password
• Never paste a private key into a web form for any purpose

Verification

You pass this item when a leaked password alone would not open the account, and a failed hard drive alone would not lose it. If either of those would ruin you, the item has not been met yet.