further context: this is for a *healthcare service*, jfc
I uh, went with “custom question” of completely random passwords bc fuck to that
looking forward to having to read one over the phone and go “ah yes so the answer to “nMXXrh_@b6v.Z2fq-ygXz8CoYeTezq8r” is “!HEzgGA@Bvjh8xw.2hfuemrFYD9Tnntq”
@ticky my go-to for this is always to use enough english words to get a good number of bits of entropy, because that's... less daunting to read back if you ever have to use it.
I mean, I know that's not breaking new ground or anything, but it's a case where human-friendliness is weighted more heavily I think?
@SomeEgrets given “security questions” are often actually functionally useless additional passwords I keep them in the same password manager (1Password) with an extremely long password. It’s synced across several of my devices, and I have web access so if I lose access I’ve really fucked up.
@SomeEgrets yeah that’s my actual approach too
@ticky anyway I actually kind of wondered what you're doing for a secure store for your recovery passwords. Because like, I was just thinking about this the other day and realised that keeping my primary passwords and recovery passwords in the same store is probably... not the greatest idea? Because now if I lose one, I've also lost the thing I'd recover it with?
Got any good recommendations for secondary storage to keep recovery passwords in?