How is Facebook's new delegated recovery more secure than a traditional recovery system

Question

I was reading through the delegated password recovery process introduced by Facebook.

I am trying to relate the whole process with traditional password recovery mechanisms (i.e., sending a reset password email to the connected mail and and the user has the option to either click the link and reset the password from there or he can copy paste a one time token to verify the email and then reset the password).

I was thinking that Facebook's delegated recovery does almost the same. Instead of email, the user is supposed to authenticate with Facebook. Instead of sending the reset password url/one-time-token, here, Facebook will send back the token associated with that account. So from my understanding, the whole email verification process is automated by Facebook to Delegated recovery.

In that case what added security does delegated recovery provide? I agree the MiTM attacks against email part. Other than that, how is this more secure than conventional methods?

Answer 1

Pros:

• The recovery provider might have two/multi factor authentication.
  • -> might be more secure than your email provider
• When your email account is hacked and an attacker takes over your account at an account provider you can recover it.

Cons

• You have to trust your recovery provider
• If someone gets access to your account at the recovery provider the person is also able to get access to your other accounts

Summary

You should only use delegated recovery when the following conditions are met:

• you trust the recovery provider
• the recovery provider provides more secure authentication, e.g. two factor authentication

Possible solution for better security

An account provider may provide a recovery system where you have to access multiple recovery providers to proof your identity, e.g. facebook and stackoverflow.