New answers tagged


With the forgot password link your user can prove to have access to "something you have". I would allow the reset of the account but would check more details like access to a second authentication factor (U2F, SMS, phone call, recovery codes). You should also moderate this account. Only allow basic interaction and force additional authentication / ...

Top 50 recent answers are included