You've built login for your application—and even added 2FA—but what happens when a customer upgrades their phone, loses their device, or otherwise gets locked out of their account? This session will show how to accommodate account recovery when the user has 2FA enabled while minimizing account takeover and support overhead.

1. KELLEY ROBINSON | TWILIO
DESIGNING CUSTOMER
ACCOUNT RECOVERY
IN A 2FA WORLD

2. © 2020 TWILIO INC. ALL RIGHTS RESERVED.
👋"🔐
Kelley Robinson
@kelleyrobinson

3. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
LIFE. HAPPENS.

4. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
What is Account Recovery?
• Replacing factors which lost access
• Proving identity to gain access to an existing account

5. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Account recovery is, in essence, a
bypass of the main account security
protocols, and therefore should be
treated as an alternative
authentication system.
Mark Loveless | Decipher, 2018

6. Average cost of a support call for account recovery:
$40 - $70/call
© 2019 TWILIO INC. ALL RIGHTS RESERVED.
Source: Best Practices: Selecting, Deploying, and Managing Enterprise Password Managers, Forrester Research 2018

7. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
INHERENCE
i.e. face ID
POSSESSION
i.e. mobile phone
KNOWLEDGE
i.e. password
AUTHENTICATION FACTOR TRADEOFFS

8. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
KNOWLEDGE
Examples
Passwords, security questions, account details
Pros
Common, easy to implement, easy to onboard
Cons
Answers can be leaked or researched,
humans are forgetful

9. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
INHERENCE
Examples
Fingerprint, voice recognition, keystroke analysis
Pros
Can't lose or forget, easy to use
Cons
Can't reset or replace

10. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
POSSESSION
Examples
Mobile phone, backup codes, hardware tokens
Pros
Can use common devices, some are not phishable
Cons
Humans lose and replace things,
harder to set up

11. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
🤔 Backup codes
Example backup codes, real messaging
https://medium.com/@alsmola/backup-codes-and-back-doors-12f20dc4829

12. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
🤔 Backup codes
Example backup codes, real messaging
Pros
Not reused like passwords, usually
hard to brute force
Cons
Easy to lose, no standard way to store
https://medium.com/@alsmola/backup-codes-and-back-doors-12f20dc4829

13. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
RECOVERY EXAMPLES

14. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
https://us.etrade.com/security-center/securityid
E*Trade
• Uses Symantec Security ID
• Requires that you contact customer
support to update the 2FA when you
get a new phone
• Limited authentication on the phone

15. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Authy
• Two factors required for account recovery
• 1-4 day waiting period
• Adaptive auth with stronger requirements
depending on the lost factor

16. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
GitHub
• Recovery tokens at setup
• Fallback options (SMS, Facebook
"recover accounts elsewhere")
• Access tokens, SSH Keys
GitHub Support: Recovering your account if you lose your 2FA credentials
Recover accounts elsewhere
• Anecdotally: fork the account then after a 6 month
waiting period, you can reclaim your dormant username

17. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Facebook
• Uses existing "friends" feature for
trusted contact recovery
Facebook Trusted Contacts

18. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
RECOMMENDATIONS

19. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
✅ Do
Require users to register
more factors than they need
to log in

20. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Design your recovery process
based on the value your
business is protecting
✅ Do

21. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
"It is mainly time, and not money,
that users risk losing when
attacked. It is also time that
security advice asks of them."
Cormac Herley | The Rational Rejection of Security Advice by Users (2016)

22. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Be intentional about if and
who you allow to reset 2FA
Add guardrails for agents
😬
✅ Do

23. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Remind users about
recovery options
twitter.com
✅ Do

24. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Remind users about 2FA before
common phone change times
i.e. holidays, new iPhone releases
✅ Do

25. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Force users to complete one
successful 2FA before
enabling 2FA
N=31 %
Google
Success 26 83%
Correctly identified completion 22 70%
Failure 5 16%
Facebook
Success 10 32%
Correctly identified completion 6 19%
Failure 21 67%
Registered YubiKey without enabling 2FA 12 38%
Windows 10
Success 12 38%
Set up the Windows Logon Authorization Tool 5 16%
Set up YubiKey for Windows Hello 7 22%
Failure 19 61%
Failed to set up the Windows Logon Authorization Tool 9 29%
Failed to set up YubiKey for Windows Hello 5 16%
Locked out of the computer 6 19%
TABLE I
LABORATORY STUDY SUCCESS RATES
F
k
th
t
l
r
a
t
p
t
n
https://isrl.byu.edu/pubs/sp2018.pdf
✅ Do

26. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
✅ Do
Add waiting periods for
sensitive recoveries

27. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Github Account Recovery

28. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
https://exchange.gemini.com/signin/forgot

29. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
❌ Don't
Only use one factor for
account recovery

30. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
❌ Don't
Deactivate 2FA on
account recovery

31. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
❌ Don't
https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html
Give up on 2FA

32. 32
THANK YOU!
@KELLEYROBINSON