AI
Why Account Recovery Is Insecure by Design
Four out of five users forget a password within 90 days. Twenty-five percent need recovery daily. Authentication has been redesigned repeatedly (passwords to passkeys) but recovery still runs over SMS and email, both outside the service provider’s control and vulnerable to SS7 attacks and SIM swap fraud.
The ARA framework models three adversaries: Eve (silent persistent access), Mallerie (permanent lockout), and Chad (spam-driven lockout). It tests every account state from no recovery method at all to full MFA, mapping the paths each adversary can take.
How the Researchers Tested 22 Major Websites
Starting from the Tranco top-1-million list, the team filtered to 22 websites and tested them with two VM environments: one simulating a normal user (known browser, known location), one simulating a semi-malicious actor (different browser, different proxy). Nine test cases walked each site through every account state, from a fresh account with no recovery method to multiple verified methods with MFA. The framework and all test cases are on GitHub.
The goal was smooth transitions between states, staying below bot-detection thresholds to reflect what a low-sophistication attacker could realistically do.
Design Flaws: Unverified Methods and Mismatched Flows
Many sites let users register a recovery email or phone without verifying ownership. If someone misspells their email at signup, recovery either breaks entirely, requires a human agent (expensive and hard to scale), or falls back to weak heuristics like recognizing a previously used device.
A second flaw: recovery flows assume the account has an email, but nothing forces users to add one. An account with only a username and password can reach a state where recovery is simply impossible, or the site grants access based on device familiarity and weakens the process for everyone.
Three Attack Classes That Exploit Recovery
Three attack classes emerged from the findings. In the parallel session attack walkthrough (18:44), Eve submits a token from a compromised recovery method and gets access while Alice stays logged in, unaware an intruder is present.
“what we call a parallel session attack.” — Gabby
In the arms race attack walkthrough (19:59), Mallerie and Alice trade recovery attempts until Mallerie changes the recovery method and locks Alice out permanently. In the skip-password attack walkthrough (21:01), Eve skips the optional password change, so Alice’s old password keeps working and Alice never notices.
Missing Best Practices Across All 22 Sites
When an MFA setting changes, sites send an alert. When a recovery method changes, most sites send nothing. Mallerie can swap out a recovery method and Alice never finds out until she tries to log in and can’t.
Most sites also skip requiring verified recovery methods or MFA at account creation, leaving users in insecure states from day one. MFA settings get reauthentication checks before changes are accepted; recovery method settings do not. Recovery methods carry the same account-access power as MFA factors and get weaker protection.
Recommendations for a Secure Recovery Flow
Every one of the 22 tested websites had at least one weakness. The minimum bar: two-factor verification during recovery, mandatory password change with no skip option, and full session termination (logged-in, pending MFA, and parallel recovery sessions) the moment any recovery completes. One site issued recovery tokens valid for 7 days; short lifetimes with visible expiry are the standard.
On alerts: notify through every available channel when account state changes or recovery succeeds. Tamper-proof activity logs give users a record they can act on independently.
Notable Quotes
what we call a parallel session attack. Gabby · ▶ 19:14
what we we call an arms race attack. Gabby · ▶ 20:44
what we we call a skip password attack. Gabby · ▶ 21:44
Key Takeaways
- All 22 tested sites had at least one security weakness in their account recovery flow.
- Recovery methods like email and SMS receive weaker protections than MFA, despite being equally powerful.
- An adversary with access to a recovery method can gain persistent or permanent account access without credentials.