I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and development time restraints, the MFA chosen is a simple TOTP solution, but in the future I may include other providers such as Authy.

In the process of developing the Password Recovery flow, I thought that if someone forgot their password, they most likely forgot/lost their MFA as well. In your experiences, is this assumption correct? What is the "best practice" here? Do I reset the MFA along with the password on password recovery, or do I force the user to authenticate through another method in order to have their MFA reset?


3 Answers 3


I would not make that assumption as it would undermine the security of having a second factor to a certain degree. A malicious factor who manages to reset a user's password (such as by exploiting a vulnerability in the password recovery flow) will then be able to take over the account by resetting MFA as well.

The password recovery flow should be separate to the MFA recovery flow by using some form of out-of-band verification such as sending a password reset link within a "forgotten password email" containing a randomly generated and unique token that allows the user to reset the password only.

The MFA recovery flow should work in a different manner. If you are offering TOTP only, I suggest offering a fallback method in place such as a list of "backup codes" of valid OTPs that the user needs to keep safe, or otherwise an OTP sent via SMS/phone call with a short expiration time. Otherwise, you will need to offer some other form of out-of-band service for allowing users to verify their personal details so that service provider can proceed with disabling MFA on his/her account.


If you assume that TOTP is lost, than you loose all the protection of TOTP during Password Reset. Consider that the attacker has hold of the account data, and accidentally the account data matches the victims email account.

Following alternatives may be applied, if you use a plain reset password link per email methods:

  • Do not ask for TOTP during reset. If an attacker gets hold of the link, he can set a new password, but not login, as TOTP should still be required during login.
  • Ask for TOTP before sending the reset link. If so, the user can only reset, if he can generate a TOTP. Also if the attacker gets hold of the link, the same situation applies as on the first alternative.
  • Ask for the TOTP while entering a new password. The reset link would be useless for the attacker.

So from what I gather here, the "best practice" is to keep the recovery / changing of MFA completely separate from the password reset / recovery.

That's what I thought, but it's nice to hear others say it too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .