Design MFA and recovery

MFA reduces damage from a stolen password, but enrollment, replacement, and recovery become new sensitive workflows.

Prefer phishing-resistant factors such as passkeys where the product allows them. Protect factor changes with recent authentication, notify the user, provide one-time recovery codes stored as hashes, and avoid security questions as a secret factor.

A second factor helps only when it is independent enough from the first. A password plus a code sent to the same compromised email account is weaker than a password plus a passkey held on another device. TOTP applications resist password reuse, but users can still type a code into a phishing site. Passkeys bind authentication to the site origin and provide stronger phishing resistance.

Enrollment is a security-sensitive state transition. Require recent proof with an existing enrolled factor when one is available, prove possession of the new factor, and notify the user through an existing channel. Do not mark TOTP active merely because a secret was displayed; require one valid code first. Protect recoverable TOTP seeds like credentials, accept only a small documented clock window, and reject replay of a code already used in that window. Factor removal and replacement deserve at least the same protection as enrollment.

Recovery codes are credentials, not convenience text. Generate high-entropy one-time values, show them once, store hashes, and consume each atomically. Avoid security questions: their answers are often public, guessable, reusable, and hard to rotate.

Support can accidentally become a universal bypass. Document what support staff may verify and what they may never override. High-value accounts may need delayed recovery, multiple proofs, or manual review, but invented personal trivia is not strong evidence.

Draw the complete lifecycle: enroll, challenge, add a second device, regenerate recovery codes, lose a device, remove a factor, and recover the account. For every arrow, state what proof is required, what notification is sent, which sessions are revoked, and how an attacker might abuse the transition.