Do account recovery options defeat stronger 2-factor authentication?

Question

2-factor authentication (2FA) is encouraged in order to reduce the risk of an account being compromised since the attacker has to know more than just your password. There are many ways to deploy 2FA, and some ways are considered weaker than others (e.g. SMS vs. Yubikey).

Services providers usually give recovery options for users in case their second factor is lost, effectively replacing one second factor for another. But doesn't this defeat any strength in the original second factor?

Answer 1

It certainly can be! When designing such a system, you need to keep in mind that the Account Recovery mechanism will reduce a 2FA system to a 1FA system, so the Account Recovery mechanism needs to be held to the same (or higher) standard than the 2FA method.

Depending on the security policy of your organization, the following would probably be acceptable as "2FA Method <= Recovery Method":

• 2FA Method: None. Recovery Method: question & answer.
• 2FA Method: SMS / email OTP. Recovery Method: email password reset link.
• 2FA Method: OTP app. Recovery Method: recovery codes that you printed during setup.
• 2FA Method: OTP token or yubikey. Recovery Method: contact your administrator.

If answering "Name of your first pet?" was enough to get into account settings and disable a Yubikey, that would be a vulnerability worth reporting for sure.