Designing consumer account recovery in a 2FA world
summary
Explains concrete recovery paths for WebAuthn and passkeys including passkeys syncing and cloud fallback to iCloud+SMS, shows that backup codes are actually used by ~1% of active users saving hundreds of support calls, cites support call cost of $40–$70 and recommends registering extra recovery factors (think 3–5 day waiting period for high-risk resets), highlights GitHub and Cloudflare recovery flows, and warns never to disable 2FA during recovery.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 3:08What is account recovery
- 8:46Types of recovery methods
- 12:35Backup codes and passkeys
- 16:04Companies doing it well
- 19:15Recommendations and best practices
- 24:48What not to do
related talks
11mAdventures in Recovery Land: Testing the Account Recovery of Popular Websites...
31mAuthentication Afterlife: the dark side of making lost password recovery harder
25mDo Passkeys Solve the Account Recovery Problem?
14mThe challenges of account recovery
24mTwo Factor Failure
50mA tale of two sides of 2FA
39m2FA, WTF?
50mOne Does Not Simply Add MFA