How to remember / where to store master password?

You can get a hardware “wallet” like a Billfodl. These are meant to secure storage your crypto-currency secret, but can work for passwords as well. These are made of high grade stainless that shouldn’t corrode easily in salt water and will survive the hottest part of a normal file.

If you get multiple of these, say 3, you can split your secret in a way that bring together any 2 and you have the whole. Mind you, access to even 1 of these would mean part of the secret is exposed. These do some with security stickers that are each unique and are tamper-evident.

You could store one in your house, one in a bank vault, and one somewhere else, like a friend/family. They even have holes which can be used to run a lock through. Someone could cut the lock, assuming it’s a decent one that can’t be easily picked, but this would require someone to be determined.

Since my threat model doesn’t include the government, a split password plus 2FA is plenty fine for me. Any person willing to jump through these real-world hoops would be an adversary I’d willingly work with.

My 2FA backup setup is several yubikeys. Both my wife and I have on our persons and we’ve cross-setup our accounts. We have a shared backup in a safe deposit box. Access to the safe deposit box requires both our physical key and the bank’s key. The bank only allows people in if they’re on a list of authorized people. And we can’t just add them to the list, that person has to come in, they have to sign a form, and their license is documented. Of course they must show proof of identity when they want to access.

The only way someone else is allowed access is through court order. And even then, if they don’t have our key, the service to drill out our lock is next day and they will attempt to contact unless the court order says they cannot.

The vault itself has a nearly 1’ thick metal door. The locking cylinders are about 6" thick each, and these go all around the door. The structure of the vault is strong enough to support this door, which says something about the structure. I’m not trying to say how safe it is against some movie grade international thieves. What it says is how safe it is against disasters. It will survive anything our local mother nature could throw at it.

Can’t get accidentally lost, destroyed, and no unauthorized access short of a court order.

1 Like