Say, I want to go the extra mile of not storing them together. What would I have to do?
- Both in same password manager is obviously storing together.
- Both on same phone, but different apps. There are the subvariants of: password manager and dedicated OTP app or two different password managers. Also there is the consideration where the apps really store the secret data, e.g. system provided vault
- OTP on a separate device
I think the middle option has too many ifs and buts and you could argue that as long as its the same device it's not really separate.
So dedicated OTP token. What should I use?
Cheap mobile phone? Does it need a SIM? Are there dedicated devices? Can they store multiple keys?
- Both in same password manager is obviously storing together.
- Both on same phone, but different apps. There are the subvariants of: password manager and dedicated OTP app or two different password managers. Also there is the consideration where the apps really store the secret data, e.g. system provided vault
- OTP on a separate device
I think the middle option has too many ifs and buts and you could argue that as long as its the same device it's not really separate.
So dedicated OTP token. What should I use?
Cheap mobile phone? Does it need a SIM? Are there dedicated devices? Can they store multiple keys?