Account Recovery

Design Account Recovery as an Authentication Boundary

A strong sign-in flow can be undermined by a weak recovery flow. Suppose an account requires a password and a phishing-resistant authenticator for normal sign-in. That protection matters only until a user loses the authenticator. If the recovery path replaces it after answering easily discovered personal questions or passing a much weaker check, an attacker can target recovery instead of the normal login. The consequence is straightforward: account recovery is another authentication path, not an administrative convenience. It must provide confidence appropriate to the account and to the access it restores.