https://nalar.dev/tags/account-recovery/ Recent content in Account Recovery on Nalar Hugo en-us Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/design-account-recovery-as-an-authentication-boundary/ Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/design-account-recovery-as-an-authentication-boundary/ <p>A strong sign-in flow can be undermined by a weak recovery flow.</p> <p>Suppose an account requires a password and a phishing-resistant authenticator for normal sign-in. That protection matters only until a user loses the authenticator. If the recovery path replaces it after answering easily discovered personal questions or passing a much weaker check, an attacker can target recovery instead of the normal login.</p> <p>The consequence is straightforward: <strong>account recovery is another authentication path, not an administrative convenience</strong>. It must provide confidence appropriate to the account and to the access it restores.</p>