Agent WranglersSecond factors and recovery
Make second factors easy to set up and recovery hard to abuse. Recovery codes, two factors each and a slow, loud last resort keep owners in and attackers out.
- Required 4
- Recommended 2
- Avoid 1
Required
Confirm a second factor before turning it on
RequiredTurn on a new second factor only after the person proves it works once, and let them give it a name.
Give recovery codes with the first second factor
RequiredWhen someone turns on a second factor, give them 10 single-use recovery codes of at least 64 random bits each, and store only their hashes.
Plan for losing every factor
RequiredWrite down one recovery path for people who lost every factor and every recovery code. Make it slower and louder than sign-in.
Tell people about every change to their sign-in
RequiredNotify every verified address within 5 minutes of a security change. That means an added or removed factor, a used recovery code, a new email or password, or a new device.
Recommended
Ask everyone to keep two ways in
RecommendedPrompt each person with one second factor to add another, such as a second passkey or a security key.
Let organisations require a second factor
RecommendedLet organisation owners require a second factor for every member, and hold members without one at a setup page.
Avoid
Never use security questions
AvoidNever use security questions, or facts such as a birth date or the last digits of a card, to sign in or recover an account.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery.