Account Recovery - Revision history

Tom: /* Solutions */

2025-06-03T04:26:57Z

‎Solutions

Tom: /* Problems */

2025-06-03T04:25:36Z

‎Problems

Tom: /* Problems */

2021-10-26T14:18:58Z

‎Problems

Tom: /* References */

2021-10-26T14:17:20Z

‎References

Tom: /* Context */

2021-10-26T14:16:11Z

‎Context

Tom: /* Context */

2021-10-26T14:13:33Z

‎Context

Tom: /* Full Title or Meme */

2021-10-26T14:11:20Z

‎Full Title or Meme

Tom: Created page with "==Full Title or Meme== ==Context== [https://authenticatecon.com/authenticate-2021-day-three-recap/ The Challenge of Account Recovery at Authenticate 2021]. A key challenge f..."

2021-10-25T23:18:56Z

Created page with "==Full Title or Meme== ==Context== [https://authenticatecon.com/authenticate-2021-day-three-recap/ The Challenge of Account Recovery at Authenticate 2021]. A key challenge f..."

New page

==Full Title or Meme==

==Context==
[https://authenticatecon.com/authenticate-2021-day-three-recap/ The Challenge of Account Recovery at Authenticate 2021].

A key challenge for user accounts is the issue of secure recovery. No matter how secure the authentication is to access an account, if there is a weak recovery system in place, an attacker will be able to bypass security.

“Account recovery is really just another form of authentication,” Dean Saxe, Sr. Security Engineer at Amazon Web Services stated.

In a session, Saxe detailed what he referred to as the Iron Triangle of Account Recovery, which includes the concerns of access continuity, security and privacy. Saxe noted that the account recovery mechanism itself should be reasonably secure, preferably as secure as the primary authentication.

“What we don’t want to create is a gate that you can walk around, or walk through because we haven’t secured the gate with a fence all the way around the thing that we’re trying to protect,” Saxe. “So the recommendation is to register multiple authenticators, so you have a backup.”

==References==

[[Category: Glossary]]

@@ Line 24: / Line 24: @@
 Join us as we discuss:
-• What good and back account recovery processes look like
+* What good and back account recovery processes look like
-• Why high quality authentication credentials require high quality account recovery mechanisms
+* Why high quality authentication credentials require high quality account recovery mechanisms
-• Deepfakes, device compromise, and social engineering demand
+* Deepfakes, device compromise, and social engineering demand
-• How a secure account recovery process can lower risk and friction for users
+* How a secure account recovery process can lower risk and friction for users
 I’ll be joined by a global group of experts:
-• Ove Morten Stalheim (BankID)
+* Ove Morten Stalheim (BankID)
-• Justin Soong (Authsignal)
+* Justin Soong (Authsignal)
-• Bertrand Carlier, CIDPRO Carlier (Wavestone)
+* Bertrand Carlier, CIDPRO Carlier (Wavestone)
-• Robert Brown (Inverid)
+* Robert Brown (Inverid)
 We need to stop treating recovery as a bolt-on solution and start treating it as a core security mechanism of your authentication and credentialing systems.
 ==References==

@@ Line 12: / Line 12: @@
 ==Problems==
 *The major issue with any [[Account Recovery]] function is the direct attack on the process to gain fraudulent control of the user's accounts.
 ==References==

@@ Line 11: / Line 11: @@
 ==Problems==
-*The major issue with [[Account Recovery]] is the direct attack on the process to gain fraudulent control of the user's accounts.
+*The major issue with any [[Account Recovery]] function is the direct attack on the process to gain fraudulent control of the user's accounts.
 ==References==

← Older revision		Revision as of 14:17, 26 October 2021
Line 16:		Line 16:

	[[Category: Glossary]]		[[Category: Glossary]]
		+	[[Category: Authentication]]

@@ Line 3: / Line 3: @@
 ==Context==
-* The original [[Account Recovery]] challenge was
+* The original [[Account Recovery]] challenge was when the registered user forgot their password.
 [https://authenticatecon.com/authenticate-2021-day-three-recap/ The Challenge of Account Recovery at Authenticate 2021].
-A key challenge for user accounts is the issue of secure recovery. No matter how secure the authentication is to access an account, if there is a weak recovery system in place, an attacker will be able to bypass security.
+A key challenge for user accounts is the issue of secure recovery. No matter how secure the authentication is to access an account, if there is a weak recovery system in place, an attacker will be able to bypass security. “Account recovery is really just another form of authentication,” Dean Saxe, Sr. Security Engineer at Amazon Web Services stated. In a session, Saxe detailed what he referred to as the Iron Triangle of Account Recovery, which includes the concerns of access continuity, security and privacy. Saxe noted that the account recovery mechanism itself should be reasonably secure, preferably as secure as the primary authentication. “What we don’t want to create is a gate that you can walk around, or walk through because we haven’t secured the gate with a fence all the way around the thing that we’re trying to protect,” Saxe. “So the recommendation is to register multiple authenticators, so you have a backup.”
 ==Problems==
 *The major issue with [[Account Recovery]] is the direct attack on the process to gain fraudulent control of the user's accounts.

← Older revision		Revision as of 14:11, 26 October 2021
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
		+	Perhaps the most difficult step to perform security is [[Account Recovery]] when the user has lost control of access to their accounts.

	==Context==		==Context==