The recovery path sets the effective security floor
Aliases: account recovery floor · weakest authentication path · recovery bypass
What it is
The recovery-path security floor reflects that an attacker will choose the easiest route that grants equivalent account control. If ordinary login requires a password and hardware key but “lost device” removes the key through a hijackable mailbox, knowledge questions, or persuadable support agent, the strong primary path does not set the real takeover difficulty.
Why it happens
Recovery is privileged: it often binds a new authenticator, resets a password, and removes old devices. Teams reduce lockout by adding exceptions outside the primary flow, with different systems and people applying each one. An attacker satisfies weaker evidence through public facts, a compromised contact channel, or social engineering, then turns temporary access into persistent control. Security belongs to the full entry, recovery, notification, and appeal state machine.
Studying it
Map every path that can obtain, restore, or elevate control, including support and enterprise administrators. With synthetic accounts, run authorized adversarial tests in which the tester controls an old email address, phone number, partial personal information, or existing session, then attempts to bind a factor and exclude the owner. Compare evidence independence, delay, notice, revocation, and appeal. Inspecting the primary login page alone systematically misses recovery bypasses.
Where it stops holding
The security floor does not require every recovery route to reproduce the missing login factor. Delay, multichannel notice, human review, temporary privilege reduction, and a reversible window can form a different but equivalent control set. High-risk accounts may tolerate slower recovery; emergencies and accessibility needs require dependable alternatives. The goal is explicit, harm-proportionate recovery risk, not permanent lockout for superficial strength.
Applying it
- Maintain one inventory from login, reset, support, administrator, and federated entry points to full-control states.
- Require an independent evidence combination to bind a new authenticator or remove an old one; never let knowledge questions be decisive alone.
- Delay high-risk recovery, notify existing channels with specific details, and let the prior holder freeze or contest before activation.
- After recovery, revoke relevant sessions, restrict sensitive actions temporarily, and audit human exceptions omitted from the threat model.