When you enable MFA for many popular services they provide you with 10
recovery codes that will allow you to temporarily disable or update your MFA settings with their service in the event that your device is lost, stolen, or simply stops working.
But why do they generate 10 codes? It's counter-intuitive to me that there would be more than a single
recovery code generated.
Is security not weakened by virtue of the fact that there are 10 codes, not one? If there's only one code the attacker must "guess" that particular code out of all possibilities. But if there's 10 codes then an attacker only needs to guess 1 of the 10 out of all the possibilities which I understand as a ten-fold increase in the probability of a successful attack.
Can anyone shed some light on the reasoning behind this?