Backup of last hope
I was thinking about what to do if I lose all my devices. The probability of this happening is non-zero for all of us, and I'd like to calmly think through a plan of action for this case, so I don't end up screaming "everything is lost" later.
The ideal option would be to remember one password and, using it, restore all my data and access from anywhere in the world with internet. I came up with one solution and I think it's quite elegant :)
I back up all my data that I wouldn't want to lose. Once a week to an external HDD, and another backup goes continuously through Syncthing to my server. In our scenario, the HDD will be lost, and to access the data on the server, I need access to the hosting provider or SSH. That's not one password anymore.
As a password manager, I use Bitwarden together with 2FA, and for 2FA I have Aegis. The latter can make encrypted backups to disk, these files are also saved on my server. Bitwarden has the ability to bypass 2FA once, through a recovery code, which is a set of 32 letters and numbers.
Okay, I know the master password for Bitwarden, but to access it I also need Aegis or the recovery code. The first method is out again, but the recovery code is hard for me to remember, especially if I don't use it regularly.
And here you can remember the immutable, decentralized and censorship-resistant "eternal" storage — blockchain :) If you write data to Ethereum, for example, it will be stored on millions of computers (nodes) around the world, you just need internet access.
So why not write my Bitwarden recovery code there? Or any other data. This can be done, since transactions in EVM blockchains support the transfer of arbitrary data (calldata). They can be passed including in a regular money transfer transaction, and the transfer can even be made to yourself, and if the transaction is successful, the data will be permanently written to the blockchain. I have very little data and the cost of such a transaction will be small even on Ethereum, and very small on networks like Polygon or Base.
Of course, I first encrypt my recovery code (or any other data), preferably with several methods, and one of them should be resistant to quantum computers (a message to the future).
To find this transaction later, you need some markers. For example, you can send it to Vitalik at vitalik.eth on your birthday :), or write some memorable number in the transfer amount (birthday again!).
And what do we get in the end. A disaster happened and I lost all my devices. I remember that I sent Vitalik my encrypted Bitwarden recovery code. I find this transaction, the encryption procedure is known to me, I remember the password, which means, after some manipulations, I get my code back. Then I go to Bitwarden, enter my master password (which can be exactly the same!), enter my code and — voilà — I get access to everything else.
With this scheme, if someone learns my Bitwarden master password, they won't be able to log in without the recovery code. And if someone, by some miracle, gets my recovery code from the blockchain, they also won't be able to log in without knowing the master password. If the passwords are the same, then the attacker must: a) somehow miraculously find out that I saved the recovery code in the blockchain b) find this transaction c) learn the methods and sequence of encryption. Each of these barriers significantly complicates the attack.
This seems like a pretty interesting and elegant idea to me, where blockchain is used for its direct purpose. Of course, you can memorize the necessary data if there isn't much (or you have excellent memory). Or they often advise storing it only on a physical medium, like a piece of paper in a bank safety deposit box, but then you're tied to the location of this medium, losing mobility.
I haven't looked for an implementation of such a thing yet, but I'll most likely do it myself and update the article.