Glossary
Account Recovery
Account recovery restores access to an account after its owner has lost the means to authenticate normally — a forgotten password, a lost second factor, a replaced phone. By its very purpose, recovery has to work even when the normal, strong authentication path is unavailable, which means it necessarily offers some alternate path around whatever rigorous authentication the account otherwise requires.
This makes recovery a frequent, and frequently underappreciated, weak point: an account protected by hardware-backed multi-factor authentication is only as strong as its recovery path, and a recovery flow that falls back to something weaker — a knowledge-based question, an easily-spoofed email loop — quietly undoes much of the protection the primary authentication method was providing in the first place.