Authentication Afterlife: the dark side of making lost password recovery harder
summary
Cloud backups plus password managers plus 2FA (TOTP, hardware tokens, SMS) still fail when a fire or theft destroys the main device and its password store or when a founder wipes devices before handover. Helpdesks and email resets are easy attack paths, recovery codes and YubiKeys often live on the lost device, and social engineering can bypass 2FA. Practical fixes include password managers with documented handover, recovery codes stored offline, role accounts and YubiKey spares, plus a living power of attorney.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:24Tabletop Scenarios
- 1:52Tabletop Scenario #1
- 2:34Administrivia
- 3:51Perils of the naive solution
- 4:02Avoiding the 2FA bypass
- 4:19Tabletop Scenario #2
- 5:00Possible solutions
- 5:47Tabletop Scenario #3
- 6:16Impersonation
- 8:05Security Questions
- 10:24Changing Password Every Login Easier Than Remembering Password
- 11:37Alternate Authentication Methods - for Attackers
- 13:33Recovery with 2FA enabled
- 14:292FA recovery
- 15:45Tabletop Scenario #4
- 16:39Unhappy Story
- 18:22Potential Mitigations
- 19:57First steps
- 20:23Ongoing steps
- 21:04Tabletop Scenario #5 - Account discovery
- 21:19Considering death
- 21:40Personal observations - 1/2
- 22:32Personal mitigations - 1/3
- 22:52Keep good records
- 23:41Personal mitigations - 3/3
- 24:50Personal mitigations - parallels
- 25:22Conclusions - 2/2
- 26:04Questions/Discussion
related talks
14mThe challenges of account recovery
26mDesigning consumer account recovery in a 2FA world
25mDo Passkeys Solve the Account Recovery Problem?
35mSecurity After Death -- Not your problem, or is it?
32mPasswords are so 1990
25mAuthentication Beyond SMS
24mTwo Factor Failure
17mGoing Beyond Passwords: The Future of User Authentication