I use Dr. Colin Percival's Tarsnap (http://www.tarsnap.com/) to back up important information from my FreeBSD machines. To keep a backup copy of the Tarsnap key, I use Whitequark's multi_iec16022.py script, which generates a nice page with six Data Matrix 2D barcodes that contain the key. You can laminate it and stash it in a strongbox, and you don't have to worry about losing your key.
Of course, you must verify the backup key before you can count on it saving you in an emergency. I always dread this part, because I scan the six barcodes with the scanner program on my phone, then I have to get them back to my FreeBSD machine, where I can assemble them and diff them against the original tarsnap.key file.
It is not always straightforward hooking the phone up to FreeBSD machine as a storage device. I could mail the scanned key to myself on the FreeBSD machine, but if the whole point is to have encrypted storage, sending the key in an email, where it will sit on the server, seems counter-productive. This time, I sent it through Proton Mail, which isn't ideal, but I trust them a lot more than I do gmail, particularly since they say they cannot decrypt the emails in transit.
But I started thinking "Why don't I have a barcode reader on the FreeBSD machine, so I can just scan the key in directly?" The answer was because barcode readers are expensive. So I looked on Amazon and discovered that they actually are not expensive; you can get one for US$ 16. So I ordered one.
This solution will probably be obvious to many of you. But I've been using Tarsnap for several years and never thought of it before, and I'm fairly sharp, so I thought I'd mention it, in case some of you didn't think of it either.
Of course, you must verify the backup key before you can count on it saving you in an emergency. I always dread this part, because I scan the six barcodes with the scanner program on my phone, then I have to get them back to my FreeBSD machine, where I can assemble them and diff them against the original tarsnap.key file.
It is not always straightforward hooking the phone up to FreeBSD machine as a storage device. I could mail the scanned key to myself on the FreeBSD machine, but if the whole point is to have encrypted storage, sending the key in an email, where it will sit on the server, seems counter-productive. This time, I sent it through Proton Mail, which isn't ideal, but I trust them a lot more than I do gmail, particularly since they say they cannot decrypt the emails in transit.
But I started thinking "Why don't I have a barcode reader on the FreeBSD machine, so I can just scan the key in directly?" The answer was because barcode readers are expensive. So I looked on Amazon and discovered that they actually are not expensive; you can get one for US$ 16. So I ordered one.
This solution will probably be obvious to many of you. But I've been using Tarsnap for several years and never thought of it before, and I'm fairly sharp, so I thought I'd mention it, in case some of you didn't think of it either.