DEV Community

Cover image for Your Recovery Path Is Your Real Login
Mungai M.
Mungai M.

Posted on

Your Recovery Path Is Your Real Login

#security #authentication #devops #cybersecurity

Open any "secure yourself" listicle and you'll get the same five items: password manager, MFA, patch your OS, don't click links, back up your data. All of it is correct. None of it would have saved Retool.

In August 2023, an attacker sent a payroll-themed text message to Retool employees. One person clicked. The fake portal collected credentials and an MFA code. Then the attacker phoned that employee using a cloned voice and talked them out of one more code, which was enough to enroll an attacker-controlled device on the employee's Okta account. From there: an active Google session, and because Google Authenticator had recently started syncing codes to the cloud, every OTP the employee held. Retool's head of engineering described the effect precisely: what administrators believed was multi-factor authentication had quietly collapsed into single-factor. Twenty-seven customer accounts were taken over. One of them, Fortress Trust, reportedly lost about $15 million in crypto.

Retool had MFA. Retool had a password policy. Retool had SSO. The checklist was complete.

What failed was the path back into the account, and nobody had priced it.

Why generic security advice keeps failing

1. It hardens the strongest door. Attackers don't attack your security posture, they attack the cheapest edge into it. Advice written as a flat list implies every item costs the same and buys the same. It doesn't. Rotating your passwords is cheap work with a modest payoff if your carrier will hand your phone number to anyone with your ID number and a plausible story.

2. It scores the login and ignores the reset. Every account you own has a second authentication system nobody advertises: account recovery. It answers the same question ("are you the owner?") while accepting weaker evidence, often a code to an address you set up years ago, or a support agent's judgment. OWASP maintains a whole cheat sheet for forgot-password flows because they are a reliable source of vulnerabilities in their own right. Your account's real strength is the weakest accepted proof of ownership, not the strongest.

3. It optimizes for one failure mode out of two. You can lose an account two ways: someone else gets in, or you can't. Checklists treat only the first as a security event. So people follow the advice, get locked out on a Saturday night, and quietly undo it. SMS recovery back on, security questions filled in with real answers, backup codes deleted because they were clutter. Advice that ignores lockout doesn't survive contact with real life. It gets rolled back, and you end up worse off than if you'd never started, because now you believe you're covered.

The common thread is that generic advice has to assume a median person, median devices, and a median adversary. Nobody is that person.

A model that scales down to one human: map the graph, price the edges

Forget the list. Draw a graph.

Nodes are the things that hold value or grant access. Edges are every path that leads into a node, including the quiet ones: password reset, "lost my device", support chat, recovery contacts, a synced cloud backup, physical possession of an unlocked laptop.

A typical personal graph looks something like this:

        [ carrier / SIM ]  <- ID document + a story at a shop counter
                 |
                 v
        [ phone number ] --------------+
                 |                     |
                 v                     v
        [ email account ]      [ bank / mobile money ]
           |         |
           v         v
    [ password    [ everything that
      manager ]     resets via email ]
           |
           v
    [ 200 accounts ]
Enter fullscreen mode Exit fullscreen mode

Three questions, in order.

Q1. Where are the roots? A root is a node that, if taken, takes many others with it. For most engineers that's the primary email account and the device that unlocks it. For anyone whose banking runs through a phone, the root is the phone number, which means the root is actually the carrier's retail staff. This varies by country, and that alone breaks most imported advice.

Q2. What is the cheapest edge into each root? Price it in attacker effort, not in how the vendor's marketing describes it. A phishing kit that proxies your login in real time costs almost nothing. A SIM swap costs a conversation. A help-desk reset costs a conversation plus some public data about you. A stolen phone whose passcode was watched over your shoulder in a bar costs the price of the drink.

Q3. Who else is standing in the blast radius? Your co-founder, your parents, a source, a group chat, a client's production environment. The controls that fit them are the ones they will actually operate, not the ones you'd pick for yourself.

Pricing the edges, with evidence

The phone network is a downgrade, and the standard now says so. In the final revision of NIST SP 800-63B (published July 2025), out-of-band authentication over the public telephone network, which includes SMS codes, is classified as a restricted authenticator. At publication it was the only method in that category. Organizations that keep using it are expected to document the risk, tell users about it, offer a non-restricted alternative, and plan a migration. The same document says email must not be used for out-of-band authentication at all, and treats changing your registered phone number as binding a brand-new authenticator, which should tell you how much weight that number carries.

The help desk is part of your attack surface. CISA and the FBI have now issued and updated advisories on Scattered Spider, whose core technique is not exotic: gather enough personal data to answer verification questions, then talk IT support into resetting a password or moving an MFA token to a device the attacker holds. SIM swaps and push-bombing fill in the gaps. If your organization's recovery process is "call support and prove you're you", that process is your authentication system, whatever your identity provider claims.

Convenience features can silently change your factor count. That's the real Retool lesson. Nobody misconfigured anything. A vendor shipped a sync feature, users enabled it, and a "something you have" turned into "something in an account protected by a password".

Physical possession plus a shoulder-surfed passcode is a full account takeover. Apple's Stolen Device Protection is the useful counter-model here: away from familiar locations it requires Face ID or Touch ID with no passcode fallback for saved passwords and payment methods, and it adds a one-hour delay plus a second biometric check before sensitive changes like the Apple ID password or trusted phone number. Recent iOS versions turn it on by default. Check that it's actually on.

The most expensive attacks aren't technical at all. The FTC reported about $16 billion in total fraud losses in the US for 2025, the highest on record and roughly 25% above 2024. Imposter scams alone accounted for $3.5 billion and nearly one in three fraud reports. The costliest pattern starts with a fake security alert, usually from "your bank", and ends with the victim moving money to protect it.

Where to spend your first 90 minutes

Roots first, then edges, then leaves.

  1. Name your roots (5 min). Write down the two or three accounts that can reset everything else. Usually: primary email, phone number, and whatever holds your password vault.
  2. Put phishing-resistant MFA on the roots only (20 min). CISA recognizes exactly two categories as phishing resistant: FIDO/WebAuthn (passkeys, security keys) and PKI-based authentication. Everything else, including TOTP apps and push with number matching, can be relayed by a proxy in real time. You don't need this on 200 accounts. You need it on the three that unlock the rest.
  3. Delete the fallbacks you don't need (15 min). A passkey on your email means nothing if "text me a code instead" is still on the login page. Remove SMS as a recovery method where the provider allows it. Where it doesn't, ask your carrier for a port-out PIN or SIM-swap lock.
  4. Kill the honest security answers (10 min). If a service forces security questions, generate random strings and store them in your password manager. Your mother's maiden name is public data.
  5. Print the backup codes (10 min). Paper, in a drawer, at home. This is the lockout insurance that stops you from undoing steps 2 to 4 in a panic six months from now.
  6. Add a recovery contact and a device you don't carry (15 min). The old tablet in the drawer is a legitimate second authenticator.
  7. Turn on alerts for account changes (15 min). You want to know within a minute when a new device is bound, not when the money is gone.

Notice how little of this is about passwords.

The drill that tells you the truth

Engineers already accept that an untested backup is not a backup. Recovery paths deserve the same rule, and almost nobody applies it.

The drill: assume it's Friday evening and your phone is gone. Not broken, gone. It's in someone else's pocket, powered off, in a city you don't live in. You have a laptop and nothing else. Now get back into your email.

Do it for real, on one account, during business hours, with your backup codes already printed and next to you.

Score three things:

  • What evidence was accepted? If a code to your phone number was sufficient, then your phone number is your password and everything above it is decoration.
  • What did you need that you weren't carrying? A code sitting only on the lost device is a single point of failure. A recovery key in a password manager whose recovery runs through the same email is a circular dependency, which is the same failure with extra steps.
  • How would a stranger have scored on this attempt? Not you. A stranger with your date of birth, your address, your last four digits, and the name of your first school. Everything on that list is purchasable.

When you find a circular dependency, break it by moving one link off the loop and onto something physical: a printed code, a hardware key, a second device that never leaves the house.

The scenario the checklist doesn't cover

Consider someone whose bank is their phone number.

INTERPOL's African Cyberthreat Assessment Report 2026 found that SIM swap fraud in Kenya surged 327% during 2025, with more than 123,000 fraudulent SIMs issued and roughly $3.8 million (about KES 491.6 million) drained from mobile wallets. The underlying figure traces back to Safaricom's own disclosure of a 327% rise in its SIM swap investigations. In the same 2024 sustainability report, the operator disclosed it had dismissed 113 employees over fraud, with SIM swap collusion among the offences.

Now run the standard advice on that graph. "Use an authenticator app instead of SMS." Fine. Where does the authenticator app's backup live? A cloud account. How is that cloud account recovered? A code to the phone number. Which was swapped ten minutes ago, possibly with help from inside the shop.

The advice wasn't wrong. It was applied to a graph it wasn't drawn for. Same words, different roots, no protection. This is the whole argument in one example: a control is only as good as its position in your graph.

For that graph the high-value moves are different. A port-out PIN or SIM lock with the carrier. A bank alert channel that isn't SMS. An email root secured with a passkey and no phone-number recovery. A transaction limit low enough that a bad hour is survivable.

For the people you're responsible for

The hardest part of this isn't your own accounts, it's the household or the small team where nobody signed up for a security programme.

Two controls do most of the work, and both are behavioural.

Verify out of band, always in the same direction. Nobody legitimate loses anything if you hang up and dial the number printed on the back of your card. Make it a standing rule rather than a judgment call, because the judgment is exactly what the pressure is designed to break. This is the direct counter to the fake-bank-alert pattern in the FTC data.

Agree a shared phrase now. Voice cloning was already good enough to move an MFA code out of a security-conscious engineer at Retool in 2023. A pre-agreed word, never sent over the channel it's meant to protect, is a cheap answer to "it's me, I'm in trouble".

Then pick controls those people will actually keep. A password manager they abandon in a week is worth less than a paper notebook in a locked drawer, which at least is offline and doesn't get phished.

The takeaway

Security work is a budget allocation problem, not a completeness problem. You will never finish the checklist, and finishing it wouldn't mean much anyway. What you can do is find the two or three edges that carry the most value at the lowest attacker cost, and close those.

Do today:

  1. List the accounts that can reset everything else. That's your root set.
  2. Put a passkey or hardware key on the root set, and remove the phishable fallbacks the provider lets you remove.
  3. Print backup codes and put them somewhere physical.
  4. Run the lost-phone drill on one account and write down what evidence it accepted.
  5. Ask your carrier for a port-out PIN or SIM-swap lock.
  6. Turn on notifications for new device enrollments and recovery-method changes.
  7. Agree a verification phrase with the people whose accounts your accounts can reach.

Then stop, and re-run the drill in six months. The graph changes every time a vendor ships a convenience feature.

The goal isn't to be secure. It's to be able to say, out loud, what you're exposed to, what you've closed, and what you've decided to accept.

Sources

This started from a security curriculum page at The Multiverse School that argues defence should begin from the people and hardware you actually have. The framework, research, and examples here are mine.

Top comments (0)