Designing customer account recovery in a 2FA world

6. Average cost of a support call for account recovery:  $40 - $70/call © 2019 TWILIO INC. ALL RIGHTS RESERVED. Source: Best Practices: Selecting, Deploying, and Managing Enterprise Password Managers, Forrester Research 2018

8. © 2019 TWILIO INC. ALL RIGHTS RESERVED. KNOWLEDGE Examples Passwords, security questions, account details Pros Common, easy to implement, easy to onboard Cons Answers can be leaked or researched, humans are forgetful

10. © 2019 TWILIO INC. ALL RIGHTS RESERVED. POSSESSION Examples Mobile phone, backup codes, hardware tokens Pros Can use common devices, some are not phishable Cons Humans lose and replace things, harder to set up

12. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 🤔 Backup codes Example backup codes, real messaging Pros Not reused like passwords, usually hard to brute force Cons Hard to store Debatable solution Email users backup codes? https://medium.com/@alsmola/backup-codes-and-back-doors-12f20dc4829

14. © 2019 TWILIO INC. ALL RIGHTS RESERVED. https://us.etrade.com/security-center/securityid <redacted> • Uses Symantec Security ID • Requires that you contact customer support to update the 2FA when you get a new phone • Limited authentication on the phone

17. © 2019 TWILIO INC. ALL RIGHTS RESERVED. GitHub • Recovery tokens at setup • Fallback options (SMS, Facebook "recover accounts elsewhere") • Access tokens, SSH Keys GitHub Support: Recovering your account if you lose your 2FA credentials Recover accounts elsewhere • Anecdotally: fork the account then after a 6 month waiting period, you can reclaim your dormant username

22. © 2019 TWILIO INC. ALL RIGHTS RESERVED. "It is mainly time, and not money, that users risk losing when attacked. It is also time that security advice asks of them." Cormac Herley | The Rational Rejection of Security Advice by Users (2016)

26. © 2019 TWILIO INC. ALL RIGHTS RESERVED. Force users to complete one successful 2FA before enabling 2FA N=31 % Google Success 26 83% Correctly identiﬁed completion 22 70% Failure 5 16% Facebook Success 10 32% Correctly identiﬁed completion 6 19% Failure 21 67% Registered YubiKey without enabling 2FA 12 38% Windows 10 Success 12 38% Set up the Windows Logon Authorization Tool 5 16% Set up YubiKey for Windows Hello 7 22% Failure 19 61% Failed to set up the Windows Logon Authorization Tool 9 29% Failed to set up YubiKey for Windows Hello 5 16% Locked out of the computer 6 19% TABLE I LABORATORY STUDY SUCCESS RATES F k th t l r a t p t n https://isrl.byu.edu/pubs/sp2018.pdf ✅ Do

30. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 🤷 Debate! • Automatically email backup codes • Trusted contact authorization • Linked site authorization (i.e. Keybase) • SMS fallback https://book.keybase.io/docs/server • BLOCKCHAIN???

35. THANK YOU @kelleyrobinson