Yesterday, I accidentally removed an authenticator app from my phone. Fortunately, I have another copy of the app on a different device. It made me realize how easy it is to lock myself out of my accounts. Do you think it’s a good idea to create a Windows VM with an Android emulator on it and install copies of all my authenticator apps, this will not cause any security issues?
You should be backing up your secrets to some type of app like Vaultwarden or KeePassXC.
And you shouldn’t need to VM host an android OS just to have a secondary means of authenticating. There are plenty of apps out there that support adding your secrets.
Vaultwarden, Bitwarden, KeePassXC, or hell, a Yubikey 5 device and then use Yubikey Authenticator.
why not consolidate your auth apps?
i use selfhosted vaultwarden (with backups ofc) for everything, except for vaultwarden, which is protected by authy . and authy can be backed up easily
Sane MFA apps explicitly disallow their data from being backed up. That would be a massive attack vector if it was possible.
Which is exceedingly dumb IMHO. Sure it would be a vector, but it’s a vector to something that should be an additional step to username and password. Idk, I use vaultwarden and find myself worrying less about “what if?”. I’m also enabling TOTP far more often now that I can easily add it to my phone and have it sync to other systems.
Instead of an android emulator, you could self-host a 2FA web app like https://github.com/Bubka/2FAuth
I think that would be the best option for what the OP is looking for. A web accessible version for OTP codes. Problem is then you have to protect that page somehow. That repo shows it can use Yubikeys for AuthN, which IMO is the best way to protect it.
I personally put my TOTP seeds in Vaultwarden. Then they sync over to whatever device I’m on. Just protect your Vault login however you need per device.
Just use a sane authenticator app that lets you export the keys, and backup those safely.
I’ve been using aegis which is available on F-Droid. Whenever I add a new “critical” account I make a backup of the data. That’s it.
I self host Vaultwarden and when adding the QR, I add it to my free account with LastPass Authenticator app at the same time. Both back up so if my phone dies, I don’t lose the 2fa.