Chapter 4
Designing your password manager and 2FA
4.1 Learning objectives
- Configure the password manager so that it does not depend on itself.
- Compare types of 2FA factors and choose the right one for each tier.
- Design backups: a second hardware key, recovery codes, an emergency kit.
4.2 Concepts
The password manager is the CORE tier
It holds random passwords for every service, TOTP codes for LEAF, secure notes and SSH keys. Because it holds everything, it must be the last thing allowed to fail, and it needs a way in that lies outside of it.
Typical unlock components
| Component | Where it is kept | Notes |
|---|---|---|
| Master password | In your head | Long, memorable (a passphrase), not used anywhere else |
| Secret key / emergency kit (if any) | Paper in a safe place + offline encrypted USB, 2 locations | Do not photograph it into the cloud |
| The password manager's own 2FA factor | Hardware key (primary) + TOTP in a different app (secondary) | Not stored in the password manager itself |
| Recovery codes | Paper / offline | Single use; regenerate after use |
Comparing 2FA types
| Type | Phishing resistance | Lockout risk | Use for |
|---|---|---|---|
| Hardware security key (FIDO2/passkey) | Very good | Lost key if you only have 1 | CORE, important BRANCH (always register 2 keys) |
| Device passkey | Good | Depends on the sync ecosystem | BRANCH, LEAF |
| TOTP (authenticator app) | Medium | Lost phone without a backup | BRANCH, LEAF |
| SMS | Poor (SIM swap) | Lost phone number | Only when there is no other option |
| Depends on the email's security | Circular if the email needs this very account | Limited |
Golden rules of MFA
- MFA must be wrapped in architecture, not left on its own.
- Strength is decided by tier: ROOT/CORE strongest with a clear exit; LEAF just needs to be good enough.
- The stronger the MFA, the more you need an exit.
4.3 Worked example
Mr. A's configuration:
- The master password is a 6-word random passphrase that Mr. A memorized and practised typing 10 times in the first week.
- The emergency kit is printed in 2 copies: one in the home safe, one with a trusted relative in a sealed envelope. One electronic copy on a hardware-encrypted USB.
- Two hardware keys: one on the house key ring, one stored with the emergency kit. Both registered for the password manager, the ROOT email and the registrar.
- TOTP for the password manager lives in a separate authenticator app on the phone, with encrypted backup.
- All LEAF passwords are random, 20+ characters; LEAF TOTP codes are stored right in the password manager (acceptable because LEAF is allowed to die).
4.4 Common mistakes
- Storing the password manager's TOTP code inside itself.
- Registering only one hardware key.
- Using recovery codes and not generating a new set.
- Photographing the emergency kit into a photo library that auto-syncs to the cloud.
- Using as the password manager's login email an email that can only be opened with a password stored in the manager.
4.5 Checklist
4.6 Exercises
- Drill: on a wiped computer, with only your memory and the emergency kit, sign back in to the password manager. Note every step where you get stuck.
- Make a table: which 2FA type each BRANCH account uses and what its backup is.
- List where your recovery codes currently are. Are any of them in a synced cloud?
4.7 Summary
- CORE must not depend on anything inside it.
- Hardware keys are the strongest factor, but you always need 2.
- A recovery drill is the only way to know whether the plan works.