Adventures in Recovery Land: Testing the Account Recovery of Popular Websites...
summary
Study sets up 2FA on 78 services (SMS most common, Google Authenticator on 25, email/password about 10%) and then tries to log in after removing the second factor and any backup codes. Findings: 65% mentioned the risk of losing the second factor, 80% offered backups but only 20% force a backup; 29 sites hint+offer without forcing while 15 force action. At login 14 websites give no recovery help. Recovery succeeds for a bit over half the accounts; checks range from email access and basic account data to ID upload or purchase history, and three sites disable 2FA after only providing the account email.
AI-written summary · about
chapters (7)
- 0:00Account recovery research intro
- 1:12Testing second factor setup
- 3:17Second factor loss warnings
- 5:04Backup options and user guidance
- 5:25Support during lockout
- 8:35Recovery success rates
- 10:42Summary of findings
related talks
26mDesigning consumer account recovery in a 2FA world
50mA tale of two sides of 2FA
31mAuthentication Afterlife: the dark side of making lost password recovery harder
14mThe challenges of account recovery
25mDo Passkeys Solve the Account Recovery Problem?
39m2FA, WTF?
25mAuthentication Beyond SMS
24mTwo Factor Failure