如何使用手动密码保护双因素认证（2FA）备份码？

Great question—securing 2FA backup codes with a manual password is a smart way to balance safety and accessibility, especially if you want to avoid relying on digital tools. Here’s a practical, step-by-step approach that’s doable by hand without sacrificing security:

1. Pick a Strong, Memorable Encryption Key (Your "Manual Password") #

• Your key needs to be at least 8-12 characters long, mixing uppercase, lowercase, numbers, and symbols. Use something only you’d remember—like a phrase converted to shorthand, e.g., "My 2024 backpacking trip was in the Rockies!" becomes M2024btwitR!
• Critical rule: Never use a key that matches any of your account passwords. This keeps your backup codes isolated even if one of your accounts is compromised.

2. Choose a Manually Computable Encryption Method #

The best option here is the Vigenère Cipher—it’s far more secure than basic Caesar shifts, and you can calculate it by hand without too much hassle. Here’s how to apply it, depending on your backup code type:

For Numeric-Only Backup Codes (Most Common) #

Simplify the cipher to work with digits only:

1. Convert your encryption key into a numeric sequence:
   • Map letters to numbers (A=0, B=1...Z=25; lowercase a=0, b=1...z=25)
   • Assign symbols to unique digits (e.g., !=7, @=8, #=9)
   • Take only the last digit of each mapped value to keep things simple (e.g., M→12→2, f→5→5)
2. For each digit in your backup code, add the corresponding digit from your repeated key, then take the result modulo 10.
   • Example: Backup code 12345678, key numeric sequence 2 5 2 0 2 3 7 2
   • Calculations: 1+2=3, 2+5=7, 3+2=5, 4+0=4, 5+2=7, 6+3=9, 7+7=14→4, 8+2=10→0
   • Encrypted result: 37547940

For Alphanumeric Backup Codes #

If your backup codes include letters, use the full ASCII-based Vigenère method:

1. Repeat your key until it matches the length of the backup code.
2. Convert each character (backup code and key) to its ASCII value (you can memorize common ones or keep a small cheat sheet stored separately).
3. Add the ASCII values of corresponding characters, then take the result modulo 256 to stay within valid ASCII range.
4. Convert the resulting ASCII value back to a character to get your encrypted code.

3. Store the Encrypted Codes Safely #

• Print the encrypted codes and seal them in a fireproof, waterproof envelope. Store this somewhere only you can access—like a home safe, locked office drawer, or a trusted friend’s secure storage. Skip the luggage—it’s too easy to lose or have inspected.
• Alternatively, write the encrypted codes in a locked notebook, but keep this notebook separate from any record of your encryption key.

4. Decrypting When You Need It #

Decryption is just the reverse of encryption:

• For numeric codes: Subtract the key’s corresponding digit from the encrypted digit. If the result is negative, add 10 before subtracting.
  • Example: Encrypted 37547940 minus key digits 2 5 2 0 2 3 7 2 → 1 2 3 4 5 6 7 8 (your original backup code)
• For alphanumeric codes: Subtract the key’s ASCII value from the encrypted character’s ASCII value, add 256 if the result is negative, then convert back to a character.

Critical Pro Tips #

• Never store your encryption key with the encrypted codes. The key should live only in your memory, or in a completely separate secure location (like a password manager that’s locked with its own strong 2FA).
• Test the process regularly—every 6-12 months, pull out your encrypted codes and decrypt one to make sure you still remember how it works. You don’t want to fumble this during an emergency.
• If you forget your key, your encrypted backup codes are effectively lost. Pick a key you can commit to memory, or keep a single, super-secure record of it (no sticky notes!).

内容的提问来源于stack exchange，提问作者Justin J Stark