Is account recovery still the weakest link in every identity system we build?
Source Reddit Cybersecurity
Discussion
This discussion highlights concerns about account recovery mechanisms being the weakest link in identity systems. Despite advances in multi-factor authentication and phishing-resistant methods, account recovery often relies on outdated, knowledge-based methods handled by help desk personnel. These methods are vulnerable to social engineering and SIM swap attacks, undermining overall security. The post emphasizes that many serious breaches involve social engineering at the help desk rather than cryptographic failures.
r/cybersecurity (opens in a new tab)u/Kondo-Sophie_2160 points0 comments
Hi r/cybersecurity, we pour effort into MFA, phishing resistant keys, conditional access, device trust. Now, when someone loses their phone, the recovery path is a help desk agent asking for a date of birth and the last 4 of something.
Every serious breach writeup I've read in the last 2 years had a social engineering step at the help desk in it. Not a broken crypto primitive.
We've mostly made peace with it. We'll argue for an hour about FIDO2 versus passkeys and then hand account recovery to whoever picks up the phone working off a script written 5-6 yrs ago.
SIM swap makes it worse. If your fallback is SMS then the whole identity chain terminates at a retail employee in a phone shop.
Knowledge-based recovery is a public dataset at this point and we keep building around it like it isn't. Am i missing something here?