Recovery abuse after a lost authenticator
How do user authentication, device trust and the local session relate?
D01 · Identity Fundamentals · D02 · Authentication · D04 · Identity Protocols & Cryptography · D06 · Workforce & Directory Identity · D11 · Identity Security & Zero Trust
Scenario
A fictional company is redesigning employee laptop sign-in. Staff need a recovery path when a primary authenticator is unavailable.
Learning outcomes
- Compare authenticator assurance and recovery risks.
- Explain FIDO2, WebAuthn, Windows Hello and smart cards.
- Draw two flows: normal sign-in and lost-device recovery. Mark every trust decision.
Engineering investigation
- Identify the user, device, verifier and session boundary.
- Compare online sign-in, offline access and credential recovery.
- Document how device posture informs access to a remote application.
Fictional attack path
An attacker exploits weak recovery checks, registers a replacement authenticator and inherits access. Examine recovery verification and session invalidation.
Detection and validation proposal
Collect identity, credential issuance, policy and resource audit events. In an authorized lab, run one allowed request and one denied request. Verify the result and attribution.
Proposed trust flow
- Employee
- Authenticator / device
- Verifier
- Workstation session
This flow is an editorial model to investigate, not a verified deployment.
Engineering trade-off
Usability and offline availability must be weighed against recovery abuse and residual sessions.
Verified source statement
Primary reference: NIST SP 800-63B-4 · Authentication. Reviewed 3 November 2026.
Only the bounded statement above is source-backed. The company context, investigation, controls and flow are teaching proposals. Confirm support and behavior in your chosen environment.
Produce evidence
Draw two flows: normal sign-in and lost-device recovery. Mark every trust decision.
Use L1 to explain the mechanism, L2 to analyze trade-offs, L3 to implement and test, and L4 to design and justify. Reading alone does not establish competence.