1

I was reading through the delegated password recovery process introduced by Facebook.

I am trying to relate the whole process with traditional password recovery mechanisms (i.e., sending a reset password email to the connected mail and and the user has the option to either click the link and reset the password from there or he can copy paste a one time token to verify the email and then reset the password).

I was thinking that Facebook's delegated recovery does almost the same. Instead of email, the user is supposed to authenticate with Facebook. Instead of sending the reset password url/one-time-token, here, Facebook will send back the token associated with that account. So from my understanding, the whole email verification process is automated by Facebook to Delegated recovery.

In that case what added security does delegated recovery provide? I agree the MiTM attacks against email part. Other than that, how is this more secure than conventional methods?

  • That's actually a good question, from my perspective I think the risks are pretty much the same. If someone access your facebook account the person will be able to easily recover password from any "delegated password recovery" associated websites. The only improvement is on the user experience. – Ricardo Reimao Feb 2 '17 at 11:39
3

Pros:

  • The recovery provider might have two/multi factor authentication.
    • -> might be more secure than your email provider
  • When your email account is hacked and an attacker takes over your account at an account provider you can recover it.

Cons

  • You have to trust your recovery provider
  • If someone gets access to your account at the recovery provider the person is also able to get access to your other accounts

Summary

You should only use delegated recovery when the following conditions are met:

  • you trust the recovery provider
  • the recovery provider provides more secure authentication, e.g. two factor authentication

Possible solution for better security

An account provider may provide a recovery system where you have to access multiple recovery providers to proof your identity, e.g. facebook and stackoverflow.

  • The last part is convincing. +1. multiple recovery providers is a great idea. Delegated recover will improve the user experience in this scenario. – Anonymous Platypus Feb 6 '17 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.