Yeah good question, and more people should give consideration to account recovery. Are you referring to recovery PINs? There’s really a couple aspects to the design:
They are single use – this is really just to make sure users aren’t coming to rely on these PINs. It’s also a simple fact that passwords that are typed are more likely to be leaked than passwords that are never typed. Single-use do a great job taking advantage of that.
They lock after very few attempts and generally have more aggressive anti-hammering/brute force/backoff protection than password/TOTP attempts.
They help get new devices registered without already having a passkey.
Securing/backing them up has the same challenges as TOTP secrets management. Storing them in a password manager is what I generally do, but there are a few that warrant keeping offline completely and storing it in a fire-resistant/water-proof enclosure.
The other reliable recovery is just registering several passkeys and keeping one as the recovery credential. I always issue two hardware keys per employee, and we have a pretty lax policy if more are needed or replaced. We also don’t allow employees to recover their own accounts. If we’re at that situation, we need to know in order to help. And FWIW, I don’t use biometrics.
Yeah good question, and more people should give consideration to account recovery. Are you referring to recovery PINs? There’s really a couple aspects to the design:
They are single use – this is really just to make sure users aren’t coming to rely on these PINs. It’s also a simple fact that passwords that are typed are more likely to be leaked than passwords that are never typed. Single-use do a great job taking advantage of that.
They lock after very few attempts and generally have more aggressive anti-hammering/brute force/backoff protection than password/TOTP attempts.
They help get new devices registered without already having a passkey.
Securing/backing them up has the same challenges as TOTP secrets management. Storing them in a password manager is what I generally do, but there are a few that warrant keeping offline completely and storing it in a fire-resistant/water-proof enclosure.
The other reliable recovery is just registering several passkeys and keeping one as the recovery credential. I always issue two hardware keys per employee, and we have a pretty lax policy if more are needed or replaced. We also don’t allow employees to recover their own accounts. If we’re at that situation, we need to know in order to help. And FWIW, I don’t use biometrics.