---
type: concept
title: Secondary Device Redundancy
tags: [security, 2fa, redundancy, disaster-recovery]
related: [2-factor-authentication, totp, keepassxc]
created: 2026-07-01
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_support_dokumentation_anleitungen_2fa_mit_totp_zweitgeraet_.md"]
---

# Secondary Device Redundancy

**Secondary Device Redundancy** is a security strategy used to prevent account lockout in systems employing Two-Factor Authentication (2FA). 

## The Problem: Single Point of Failure
When a user relies solely on a smartphone for [[totp]] code generation, the loss, theft, or malfunction of that device creates a single point of failure. Without access to the TOTP generator, the user is locked out of their account, requiring administrative intervention to reset the 2FA secret.

## The Solution: Secondary Configuration
The URZ recommends configuring a second, independent device (such as a PC or Notebook) to generate the same TOTP codes. 

### Implementation via KeePassXC
The university's recommended implementation involves:
- Using **KeePassXC** on a computer as the secondary generator.
- Manually importing the **TOTP Secret** from the [[ums]] into KeePassXC.
- Ensuring the KeePassXC database is backed up or stored on the central file server to maintain the availability of the secondary key.

By having the same secret synchronized across two devices, the user ensures that they can still authenticate even if their primary smartphone is unavailable.
