I was reading through the delegated password recovery process introduced by Facebook.
I am trying to relate the whole process with traditional password recovery mechanisms (i.e., sending a reset password email to the connected mail and and the user has the option to either click the link and reset the password from there or he can copy paste a one time token to verify the email and then reset the password).
I was thinking that Facebook's delegated recovery does almost the same. Instead of email, the user is supposed to authenticate with Facebook. Instead of sending the reset password url/one-time-token, here, Facebook will send back the token associated with that account. So from my understanding, the whole email verification process is automated by Facebook to Delegated recovery.
In that case what added security does delegated recovery provide? I agree the MiTM attacks against email part. Other than that, how is this more secure than conventional methods?