A very convenient place to store and retrieve them is under a "passwords" folder in your private mail account or your Dropbox, both of which get synchronized with your unprotected smartphone...
I store them in Keepass files and then bury them/give to a friend/save in the cloud/whatever. It's just a single password that you remember, with no reliance on an external authenticator or like. And if someone finds your files, they're useless without the password.
If you store them on cloud, you should obviously do so on a service with no 2FA and a password you remember. The first priority is that you can access it anywhere and the main protection comes from the encrypted Keepass file.
Use Dropbox, sync the DB to a flash drive aka use a more robust solution than a smartphone, or get used to it that encrypted passwords may mean there will be situations where you wont have access to them.
Use the text based secret and save a copy in an encrypted file and keep it on a usb memory stick. Put that in a safety deposit box if are paranoid enough. Either way, you lose your phone you have all your auth secrets available to re-enter.
You could just store them in a separate password manager like BitWarden? Or even encrypted in a separate Dropbox account?
Ultimately if you want to be able to recover your identity from anywhere in the world with absolutely nothing on you except cash (to buy a new device and service), you have to store this data somewhere. And you wouldn’t store this data in the same place that you’re trying to recover because that’s not very useful.
Is it without risk? No, but there is no risk-less way to be able to recover a piece of data once you lose all your possessions somewhere random in the world because the only thing you have left that you can still use is what you know.
I keep some Google and Github account recovery codes on a slip of paper with my passport, some more in my wallet, and all in an encrypted file on a server with SSH access.
Hopefully that's enough that I'm not too inconvenienced, should my phone be stolen.
Or just keep them somewhere that isn’t directly beside the password?
I have my password in a password database, and my TOTP tokens on my phone and a Yubikey.
I have a second “break glass in case of emergency” password database that contains TOTP secrets for all my most essential accounts and a backup of the key loaded on my Yubikey.
I keep mine in a file in a drawer. My threat model doesn't cover people breaking in and finding them as well as knowing my password managers master password.
The safest way to store passwords is written down on a piece of paper. Maintain physical custody of it, never let it out of your possession.
If you need backups, use a non-networked copier, or an old style stand-alone point and shoot camera. Don't ever put the SD card in your computer. Keep all copies as secure as the original.
Banks have safety deposit boxes that can offer relative security. If you really want to be safe, manually encrypt your passwords.
[Edit] As others have pointed out, phishing is an issue. Be careful where you enter your passwords.
reply