01.06 · Concept
Verification & Account Recovery
Design a password reset and account recovery path that does not become the weakest way into the account.
Account recovery is an alternative authentication path, not a support convenience. A safe reset design treats email links, SMS codes, backup codes, device approvals and support workflows as account keys, then limits their lifetime, reuse, scope and risk. The goal is to recover access without making recovery easier to attack than normal login.
What this lesson answers
- how to design secure password reset flow
- why account recovery weakens authentication security
- what makes recovery safer than security questions
Notes
Account recovery is authentication under stress: the user has lost the normal proof, so the system must decide what alternate proof is strong enough. A password reset link, one-time code, support ticket, backup code, or device approval is not a side feature; it is another login path. Attackers often choose recovery because it may be less monitored, less protected, and more likely to involve rushed humans.
A good mental model is to treat every recovery method as a key to the account and rank keys by strength. Email reset is only as secure as the email account.
References
Common questions
- Why is password reset part of authentication security?
- A reset flow can grant the same outcome as logging in: control of the account. If an attacker can use recovery to change the password, disable MFA or redirect email with weaker proof than normal login, the reset path becomes the practical authentication mechanism. It needs the same threat modelling, logging and abuse controls as sign-in.
- Are SMS codes safe for account recovery?
- SMS codes are better than guessable questions, but they are tied to the security of the phone number. Number takeover, SIM swap and compromised devices can make them unsafe for high-risk actions. They work best as one signal among others, with rate limits, user notifications and stronger checks before sensitive account changes.
- What should happen after a reset link is used?
- The token should stop working immediately, and the account should record the event for audit and abuse detection. Existing trusted channels should be notified, especially if credentials, MFA settings or contact details changed. For sensitive changes, require fresh verification rather than treating possession of the reset link as unlimited authority.
Short definition: what is Verification & Account Recovery?