Set things up so losing the phone is survivable
Arrange your accounts so that if your phone vanishes tomorrow — stolen, dropped in a river, simply dead — you can still get into everything within an hour, without needing that phone.
Two-step sign-in was the best thing you did for your accounts. It also quietly made every one of them depend on a single object you carry around in a coat pocket. That is a fine arrangement right up until the object is gone.
The picture worth having in your head is a chain. Your email can reset nearly every account you own. Your phone receives the codes that protect your email. So the phone protects the email, and the email protects everything. Lose the first link on a Tuesday and you can be locked out of your own life by Wednesday.
The fix is not to stop using two-step. It is to make sure that at every point where you could be asked to prove yourself, you have two different ways of doing it, and that the second way is not sitting in the same coat pocket as the first.
Doing these in order matters, because each one makes the next one safe to do. Start at the email account, because everything else leans on it.
The right-hand column is the whole point. A second key that is kept in the same place as the first is not a second key. Every entry there fails on exactly the day you would reach for it.
Key points
- Two-step made every account depend on one object in your coat pocket
- Email can reset nearly everything, so the chain starts there
- At every point, have two ways in — and keep them in different places
- Recovery codes on paper, with the passport, beat every clever alternative
- A photograph of the codes on the phone fails on the exact day it is needed
- A trusted person should hold nothing until the morning you ask
What to remember
- A second key kept in the same place as the first is not a second key. Sort every arrangement by where it physically lives.
- Email first, always. It is the account that can open the rest, so it is the one that needs two ways in.
- A good trusted person holds nothing until the day you need them. Access that sits there permanently is a risk that sits there permanently.
Try this
Do only the first one this week. Open your email account’s security settings, find the recovery or backup codes, print them, and put them with your passport. It takes about ten minutes and it is the single change that turns losing a phone from a catastrophe into an errand.
Practice: Set things up so losing the phone is survivable. Your first lesson is free, with no account or card; the rest are part of a Lantern plan. Interactive lessons require JavaScript.